Google and Mozilla release updates to patch over 200 browser vulnerabilities

Google and Mozilla have released security updates for Chrome and Firefox to address more than 200 vulnerabilities. The Chrome 156 update includes patches for 52 security defects, including four critical-severity flaws such as memory corruption in FileSystem and use-after-free issues in Layout. One specific bug, CVE-2026-118306, could potentially allow arbitrary code execution outside the sandbox via a crafted HTML page.

Mozilla released Firefox 159 to patch 167 security defects, including 108 high-severity flaws. These fixes primarily address use-after-free issues, sandbox escapes, privilege escalation, and same-origin policy bypasses. Mozilla also issued updates for Thunderbird and Firefox ESR.

The Indian Computer Emergency Response Team (CERT-In) issued a critical-severity warning regarding these Chrome flaws, noting that attackers could exploit them through specially crafted web requests to execute arbitrary code, steal sensitive data, or cause denial-of-service conditions. While there are no reports of these bugs being exploited in the wild, both companies advise users to update their browsers immediately.