Critical Use‑After‑Free Flaws Patched in Chrome 156 and Firefox 159 – Update Now
What Happened — On 27 October 2026 Google released Chrome 156.0.8078.73/74 for Windows, macOS and Linux, and Mozilla released Firefox 159 together with Security Advisory 2026‑118. The updates address a total of 219 vulnerabilities, including four critical use‑after‑free bugs in Chrome and numerous memory‑handling flaws in Firefox. Use‑after‑free bugs can lead to crashes or remote code execution if an attacker tricks the browser into accessing freed memory. Both vendors credit AI‑assisted research (OpenAI Codex and Anthropic) for discovering many of the issues. The patches roll out automatically over the next days, but users can also force a manual update via the browsers’ “About” pages.
Why It Matters for Trust & Control Assurance — Timely patching of critical browser flaws is a core control‑assurance requirement for maintaining a defensible security posture.
Who Is Affected — All organizations that allow employees to browse the web on Windows, macOS, or Linux workstations – spanning finance, healthcare, retail, manufacturing, education, government, and SaaS providers.
Recommended Actions
- Enable automatic updates for Chrome and Firefox on all endpoints.
- Verify that the latest versions (Chrome 156.0.8078.73/74, Firefox 159) are installed across the fleet; use an endpoint‑management tool to collect evidence.
- Document the patch‑management process and retain logs as audit evidence for frameworks such as NIST CSF 2.0 or ISO 27001.
- Incorporate AI‑assisted code‑review findings into your vulnerability‑management program to surface similar memory‑handling bugs early.
Source: Malwarebytes Labs
Technical Notes
- Vulnerability type: use‑after‑free memory errors in page layout, JavaScript engine, and SVG rendering.
- No public CVE IDs were listed in the advisory; the fixes are bundled in the regular browser releases.
- AI tools (OpenAI Codex, Anthropic) contributed to discovery, underscoring the growing role of machine‑learning in vulnerability research.
Source: same as above