Chrome 156 and Firefox 159 fix over 200 security flaws: how to update

Your web browser is the program most exposed to the internet, so it is worth two minutes today. Google and Mozilla released Chrome 156 and Firefox 159 on October 27, fixing more than 200 security flaws between them, including one Chrome bug that could let a booby-trapped web page run code outside the browser’s protective sandbox.³ Updates download by themselves, but they only take effect after you restart the browser.⁴

Reporting checked October 28, 2026.

Too long; didn’t read?

• Chrome 156 fixes 52 security issues, including four rated critical, according to Google and SecurityWeek.³
• Firefox 159 fixes 167 security issues, SecurityWeek reports.³
• Neither vendor reported these bugs being exploited in real attacks, according to SecurityWeek’s October 28 report.³
• Chrome for Android and ChromeOS also have new Stable releases in Google’s October notices.¹

What the browser makers confirmed

Google’s desktop notice lists Chrome 156.0.8078.73/.74 for Windows and Mac, and 156.0.8078.73 for Linux, with delivery over the coming days or weeks.¹

The critical Chrome fixes cover FileSystem, FileAPI, Skia and Layout, according to Google’s list.¹

Mozilla’s advisory names Firefox 159 as the fixed version and rates the advisory high overall.² Its list includes sandbox escapes in the navigation and form-management components.² A sandbox is a protective boundary that limits what browser content can do.

Mozilla also explains that it now lists memory-safety bugs it found itself one by one, instead of grouping them under a single identifier, which is part of why the number looks so large.²

Are attackers already using these flaws?

Not as far as anyone has said publicly. SecurityWeek reports that Google and Mozilla make no mention of these bugs being exploited in the wild.³ But details of fixed bugs become easier to find once updates are out, which is why updating promptly matters.

Google says it may restrict access to bug details until most users have received a fix.¹ There is no need to wait for a report of an attack before installing the update.

Android and Chromebooks have updates too

Google announced Chrome 156.0.8078.73 for Android on October 27, with Google Play availability over the following few days.¹ Its notice says Android gets the corresponding desktop security fixes unless otherwise stated.¹

On October 28, Google announced ChromeOS 16836.30.0, containing browser version 156.0.8078.77, for the Stable channel.¹ Google also began an early Chrome 157 rollout to a small percentage of Windows users that day.¹ If your browser offers you a newer version than the ones named here, that is fine: just install it.

What you can do

Save unfinished work, then follow the instructions for each browser you use.

1. Chrome on Windows or Mac: open the three-dot menu, choose Help → About Google Chrome, let it check for updates, then select Relaunch if offered.⁴
2. Firefox downloaded from Mozilla: open the menu and choose Help → About Firefox (on Mac, Firefox → About Firefox), let the update download, then select Restart to update Firefox.⁵
3. Microsoft Edge: open Settings and more → Help and feedback → About Microsoft Edge, select Download and install if shown, then Restart when requested.⁶
4. Brave: choose Menu → Help → About Brave, wait for any available update to download, then relaunch the browser to apply it.⁷
5. Chrome on Android: open Google Play, tap your profile icon, choose Manage apps & device, find Chrome under available updates and tap Update.⁹
6. Chromebook: connect to Wi-Fi, select the time, open Settings → About ChromeOS → Check for updates, and restart to finish any downloaded update.⁸

On Linux, Google’s instructions direct Chrome users to their package manager, the system’s software-update tool.⁴ Mozilla likewise says Firefox supplied by a Linux distribution uses system updates, while Microsoft Store installations receive updates through that store.⁵

Google says browsers built on Chromium, the shared browser code, have different gaps between a fix and its delivery to users.¹⁰ So if you use Edge, Brave, Opera or Vivaldi, check those for updates separately over the next few days.

Sources

1. Google Chrome Releases, October 27-28, 2026: Stable channel updates for desktop, Android and ChromeOS
2. Mozilla, October 27, 2026: Security Vulnerabilities fixed in Firefox 159
3. SecurityWeek, October 28, 2026: Chrome and Firefox Updates Patch Over 200 Vulnerabilities
4. Google Chrome Help, Update Google Chrome — Computer
5. Mozilla Support, Update Firefox to the latest release
6. Microsoft Support, Microsoft Edge update settings
7. Brave Help Center, July 10, 2025: How do I update Brave?
8. Google Chromebook Help, Update your Chromebook’s operating system
9. Google Chrome Help, Update Google Chrome — Android phone & tablet
10. Google Security Blog, August 8, 2023: An update on Chrome Security updates – shipping security fixes to you faster