Chrome and Firefox Patch Serious Browser Flaws, Including Four Critical Chrome Bugs
Vulnerability Disclosure · 12 sources · Updated 4d ago · First seen Oct 28, 2026
Google and Mozilla released browser security updates addressing 52 vulnerabilities in Chrome and 167 vulnerabilities covered by Mozilla Security Advisory 2026-118. Chrome’s fixes include four critical flaws: memory corruption in FileSystem (CVE-2026-118306), improper input validation in FileAPI (CVE-2026-118331) and Skia (CVE-2026-118348), and a use-after-free vulnerability in Layout (CVE-2026-118344). Both browser releases address use-after-free flaws involving web-content processing.
Organizations should prioritize updating desktop Chrome to 156.0.8078.73/.74 on Windows and Mac or 156.0.8078.73 on Linux, and Firefox to 159.0 or later. Chrome’s staged rollout may take days or weeks, so manually checking for updates can accelerate deployment. Both vendors credited OpenAI Codex Security with discovering bugs fixed in these releases; Google also credited Anthropic researcher Xinyang Ge, assisted by Claude, for two critical Chrome findings. The supplied reports do not state that these vulnerabilities are being actively exploited.
