Chrome and Firefox both shipped big security updates this week, and one of them climbs the sandbox wall

Google released Chrome 156 on 27 October with 52 security fixes. Four are rated critical, and one deserves its own sentence: CVE-2026-118306, memory corruption in Chrome's FileSystem component that Google says a crafted web page could use to run code outside the sandbox. The sandbox is the wall between a page you visit and everything else on the machine. Bugs that get over it are the reason browsers patch on this schedule.

Mozilla put out Firefox 159 the same week and the count is larger still, 167 vulnerabilities with 108 rated high. Most are use-after-free flaws, where the browser reaches for memory it has already handed back. Neither company has seen any of these used in attacks, which is the good news. The less good news is that the details are public now, and that gap has a habit of closing quickly.

There is a detail in both advisories that says something about where this is going. Google and Mozilla each credit OpenAI Codex Security with finding bugs in these releases. Automated review is turning up real flaws at volume, which probably means more fixes arriving more often rather than fewer bugs existing.

Updating takes under a minute, and the step people skip is the last one. In Chrome, open Help then About Google Chrome; it downloads on its own, but the new version does not run until you click Relaunch. Firefox is the same under Help, About Firefox. If you have three browsers installed and no idea which ones are current, Tendvane's app update check uses winget to show what is behind and bring them all up in one go.