On October 27, Google moved Chrome to version 156.0.8078.73 and .74 for Windows and Mac, and 156.0.8078.73 for Linux, with 52 security fixes, four of them rated Critical. Mozilla released Firefox 159 the same day with 167 fixes listed in its Security Advisory 2026-118. The two browsers are separate codebases, and the counts are separate: 52 flaws on one side, 167 on the other.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
Both vendors credit AI tools with finding part of the haul, which is the unusual detail in an otherwise routine round of patching. Chrome’s credits name Claude and OpenAI Codex Security, and Mozilla’s advisory names Codex Security and an OpenAI researcher, Amy Burnett, as sources of reports. Neither the Google post nor the Mozilla advisory describes the fixes as an out-of-schedule release, and both read as ordinary patch-day documents in format, though the flaw counts are far above normal for a single week.
Chrome 156.0.8078.73 and its four Critical bugs
Google’s own Stable channel post gives the version numbers for the October 27 release. The detail on the flaws comes from a German write-up at Windows-FAQ, which lists the four Critical bugs: CVE-2026-118306, a memory corruption in the FileSystem component; CVE-2026-118331, insufficient input validation in FileAPI; CVE-2026-118348, insufficient input validation in Skia; and CVE-2026-118344, a use-after-free in page layout. It adds that the page carries no vendor confirmation of active attacks.
Credit for two of the Critical bugs, CVE-2026-118306 and CVE-2026-118331, goes to Xinyang Ge, described in the Windows-FAQ account of the release notes as working from Anthropic’s environment with help from Claude. The other bugs on that list were found with OpenAI Codex Security. The Windows-FAQ page names no individual reporters for them and lists no bounties.
The 156 line is also large by recent standards. SecurityOnline reported that the original Chrome 156 release on October 20 carried 353 security fixes, roughly ten times the 37 in Chrome 155, with no exploited flaws and none in the CISA known-exploited catalog. The October 27 build is a follow-up to that release, not a fresh major version.
For anyone checking a machine, the numbers that matter are specific. A Windows or Mac copy of Chrome should report 156.0.8078.73 or .74 after the update, and a Linux copy 156.0.8078.73. Anything lower is missing the October 27 fixes, including the four Critical bugs, and a browser that has downloaded the update but never relaunched is still running the old code.
Firefox 159 and advisory 2026-118
Mozilla’s advisory 2026-118 lists each of the 167 CVEs individually: 108 rated High, 52 Moderate and 7 Low. Most entries credit Mozilla’s own engineers. External credit goes to OpenAI Codex Security, under the name kylebot, on about 40 entries, and to Amy Burnett of OpenAI on several more, alongside a long list of independent researchers that includes Takashi Suzuki, Minseong Kim and Shu Takahashi of Velcore Consulting.
The severity split is lopsided. Of the 167 CVEs, 108 are rated High, about 65 percent, against 52 Moderate and 7 Low, and the severity breakdown lists no Critical entries, so the remarkable figure is volume rather than any single catastrophic bug. The long tail of independent reporters, among them Nguyen Thanh Nguyen, Yaqoub Aldurayhim, Massimo Palozzi, Ibuki Sato and Abdulrahman Alzahrani, shows that human researchers still contributed alongside the AI-assisted finds.
Malwarebytes writer Pieter Arntz, in the post that tied the two releases together, points out that both vendors fixed use-after-free bugs in page layout, JavaScript processing and SVG graphics. In that class of bug, code keeps using memory after it has been released, which can crash the browser or let an attacker run code. Arntz also reports that Mozilla worked with Anthropic, whose researchers validated vulnerabilities before reporting them so that Mozilla received reproducible bugs.
Put in proportion, OpenAI Codex Security appears on about 40 of the 167 entries, roughly a quarter, and most of the rest are credited to Mozilla itself. The vendor split on AI credit therefore differs between the two browsers: Google names Codex Security and Claude on individual Chrome bugs, while Mozilla attributes the bulk of its list to internal work and names outside AI-linked reporters only on a minority of CVEs.
Forcing the update by hand
Browsers normally update themselves, but Arntz notes that automatic updates can lag when someone rarely closes the browser or an extension blocks the process. Google’s instructions on updating Chrome run through the three-dot menu to Help, then About Google Chrome, then Relaunch; Incognito windows do not reopen afterward. On Windows, all Chrome windows have to close before the relaunch takes effect.
Mozilla’s Firefox update guide follows the same pattern: menu, Help, About Firefox, wait for the download, then Restart. The version afterward should read 159.0 or later, and the method does not apply to installations from a Linux package manager or the Microsoft Store. The unanswered question is how many of the 219 combined fixes were found by AI tools, since neither Google nor Mozilla has published that total.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Ford is recalling 223,472 F-150 pickups because the fuel tank can leak or detach
- Hybrids have 15% fewer problems than gas cars, while EVs and plug-in hybrids have about 80% more, Consumer Reports finds
- Regulators cleared the first U.S. small modular reactor, 4 months early
- Lake Powell sank to a record 3,517 feet, nearing the level that stops Glen Canyon Dam’s turbines
