Short answer: update both browsers today
If you use Google Chrome or Mozilla Firefox, update them now. On October 13, 2026, Google and Mozilla shipped security updates that fix a combined 114 vulnerabilities: 37 in Chrome 155 and 77 in Firefox 158. Seven of the Chrome flaws are rated critical, and 30 of the Firefox flaws are rated high severity. Neither company has reported any of these flaws as actively exploited, which makes this the best kind of security week: patches are available before attackers have had a chance to weaponize the bugs. The fix takes about a minute per browser, and a restart finishes the job.
The same day, Mozilla also launched Firefox Enterprise, a version of Firefox aimed at organizations that want to manage the browser themselves instead of handing that control to a vendor cloud. Here is what changed, what the flaws actually mean, and what to do.
Chrome 155: 37 security fixes, including 7 critical flaws
Google released the Chrome 155 security update on Tuesday, October 13, 2026, as a Stable Channel update for desktop. The patched builds are 155.0.8059.79 and 155.0.8059.80 for Windows and Mac, and 155.0.8059.79 for Linux. Chrome for Android received the same security fixes in version 155.0.8059.79, and an iOS update shipped the same day.
The severity breakdown is 7 critical, 29 high, and 1 medium. As usual with Chrome, memory-safety bugs dominate the list. Most of the 37 flaws are use-after-free vulnerabilities, a class of bug where the browser keeps using memory after it has been freed. Attackers can abuse that kind of mistake to corrupt memory and, in the worst case, run code on the victim machine. A single malicious web page can be enough to trigger one.
The critical Chrome flaws to know about
Google highlighted seven critical issues in this release:
- A buffer overflow in ANGLE (CVE-2026-110152). ANGLE is the graphics layer Chrome uses to translate graphics calls on Windows and other platforms. A buffer overflow here means data can be written past the memory set aside for it, which is a classic route to code execution.
- Six use-after-free flaws across core browser components, including the browser core (CVE-2026-110149), PDF handling (CVE-2026-110136), and other components covering networking, SVG, and media.
Google is keeping full technical details restricted until most users have updated, which is standard practice to avoid handing attackers a working exploit recipe. What matters for users is simple: the patched builds close all seven holes.
AI-assisted researchers found a large share of these bugs
One detail worth noting is who found the flaws. Coverage of the release notes that at least 15 of the Chrome vulnerabilities were reported by Anthropic researcher Xinyang Ge with assistance from Claude, and that Google said no bounty would be paid for those reports. Whether or not you follow the bounty debate, the pattern is now hard to miss: AI systems are finding real browser bugs at scale. Google has previously disclosed that its own AI agent PageBreak found more than 500 XSS vulnerabilities, and AI-assisted reports keep showing up in major browser releases. The same tools that find bugs for defenders can find them for attackers, which is one reason browser updates keep arriving in large batches.
What about Microsoft Edge?
Edge is built on the same Chromium engine, so it inherits the same underlying flaws. As of October 13, Microsoft had not yet released the corresponding Edge Stable update, though it said it was aware of the Chromium fixes and working on a security update. Edge users should check for updates over the next few days rather than assuming they are already protected. The same logic applies to any other Chromium-based browser: the fix only counts once your specific browser ships it.
Firefox 158: 77 security fixes
Mozilla shipped Firefox 158 on October 13, 2026, with fixes for 77 security vulnerabilities, 30 of them rated high severity. The flaws span a wide range of classes: use-after-free bugs, sandbox escapes, privilege escalation, information disclosure, race conditions, JIT miscompilation, and integer overflows. That breadth is a reminder that a modern browser is really a small operating system, with a JavaScript engine, a rendering engine, media codecs, and a sandbox all running at once.
Mozilla also changed how it publishes advisories with this release. Instead of rolling internally found memory-safety bugs into a single advisory entry, it is now issuing an advisory for every individual bug. The result is a much longer list, but a more honest one: users and administrators can see exactly what was fixed.
The same round of fixes reached Thunderbird 158 and 153.5, plus Firefox ESR 153.5 and 115.43 for organizations on the extended support channel. If your workplace manages Firefox through ESR, check with your IT team that the ESR build has been deployed, since ESR does not always update on the same day as the main release.
Firefox 158 is more than a security patch
The update also brings user-facing improvements, including JPEG XL image support, a PDF viewer that starts up to 45 percent faster, lower memory and CPU use when displaying large scaled-down JPEG images, and hardware H.264 decoding for WebRTC video calls on Windows ARM64 devices. None of that changes the priority, though: the security fixes are the reason to update today rather than next week.
Mozilla launches Firefox Enterprise
Alongside the patch, Mozilla launched Firefox Enterprise, a version of Firefox aimed at organizations with strict security, governance, and compliance requirements. The pitch is control: the browser runs on Mozilla Gecko engine, and the management console runs on the organization’s own infrastructure rather than in a vendor cloud.
Through the console, IT teams can manage browser policies and access, govern how data moves through the browser, and set controls around AI use. The product is designed to slot into systems companies already run, so organizations keep their existing identity providers, SIEM platforms, and mobile device management tools. Device posture checks can block sign-in until a machine meets standards, such as having an encrypted drive and security software running. Per-site data rules can restrict pasting, uploads, downloads, and printing, and admins can warn employees rather than blocking them outright where a full block would be too heavy.
The AI controls are the most timely part. Employees routinely paste customer records, patient details, and internal documents into AI tools inside the browser. Firefox Enterprise lets administrators set rules about which AI services are allowed and what data can go to them, instead of discovering the problem in an audit months later.
The rollout starts in Europe, with France, Germany, Austria, and Switzerland as the first markets and more to follow. Early access is request-based rather than an instant download, and Mozilla has not published pricing. Thunderbird Enterprise, which would extend the same customer-controlled approach to email, is still in development.
Mozilla is framing the launch as a sovereignty play. Most competing enterprise browsers are built on Chromium, so organizations that want independence from a single browser engine have had few options. Firefox Enterprise is Mozilla’s attempt to turn that independence into a product, aimed at governments, hospitals, banks, and other regulated institutions where control over data and infrastructure outweighs familiarity. Firefox holds a single-digit share of desktop browsing, but enterprise adoption in regulated sectors could matter more than raw market share.
How to update Chrome and Firefox right now
Both browsers update themselves in the background, but the patch only takes effect after a restart. Do not assume you are protected just because an update downloaded.
- Chrome on desktop: Open the three-dot menu, go to Help, then About Google Chrome. Chrome checks for updates and shows your version. If it says a newer version is available, let it install, then click Relaunch. Confirm you are on 155.0.8059.79 or later (Windows and Mac may show .79 or .80).
- Firefox on desktop: Open the hamburger menu, go to Help, then About Firefox. Firefox checks for updates and downloads them. Click Restart to Update, then confirm you are on version 158.
- Chrome on Android: Open Google Play, search for Chrome, and tap Update if it appears. The patched build is 155.0.8059.79.
- Firefox on Android and iOS: Update through Google Play or the App Store, then reopen the browser.
- Enterprise and school devices: If your browser is managed, the update may be pushed by your IT team. Check your version anyway, and report it if you are still on an older build.
Why browser updates deserve the same urgency as OS patches
Browsers are the most exposed software most people run. They parse untrusted content from every site you visit, run JavaScript from advertisers and third parties, and hold your logins, cookies, and session tokens. A single exploited browser flaw can hand an attacker all of that in one visit, without any download or visible warning.
This week is a good illustration of the pace. Microsoft October Patch Tuesday fixed a record 1,411 flaws, including an exploited Windows Shell zero-day, in the same week Chrome and Firefox shipped 114 fixes between them. Apple patched a zero-day earlier in the month, and SonicWall warned of a CVSS 10.0 flaw in its VPN appliances. The practical lesson is the same in every case: patch promptly, restart to finish the update, and treat any device that has not been updated as exposed.
Two habits make the biggest difference. First, restart your browser when it asks. Pending updates that never get a restart are the most common reason patched people stay vulnerable. Second, keep the number of browser extensions small and remove ones you no longer use, since extensions run with broad permissions inside the same trusted space as the browser itself.
Frequently asked questions
Is Chrome 155 safe to install?
Yes. Chrome 155.0.8059.79 and later fix 37 security vulnerabilities, including 7 critical flaws. Installing the update and restarting the browser moves you to the patched build. There is no reason to wait.
Do I need to update Firefox if I mainly use Chrome?
Yes, if Firefox is installed on your machine. An outdated browser is a risk even if it is not your default, because links from other apps can open in it and because its stored data is still on the device. Update every browser you have installed, then restart each one.
Are any of these 114 flaws being exploited in the wild?
Google has not reported any of the Chrome flaws as exploited, and Mozilla’s advisory does not describe active exploitation for the Firefox flaws. That is exactly why updating now is valuable: you can close the holes before exploit code circulates.
What is Firefox Enterprise, and can I download it?
Firefox Enterprise pairs the Firefox browser with a self-hosted management console for organizations. It is aimed at IT teams in regulated sectors, not home users. Early access is request-based, starting in France, Germany, Austria, and Switzerland, and pricing has not been disclosed. Home users should simply update to Firefox 158.
How do I check which Chrome or Firefox version I am running?
In Chrome, open the three-dot menu, go to Help, then About Google Chrome. In Firefox, open the hamburger menu, go to Help, then About Firefox. You want Chrome 155.0.8059.79 or later, and Firefox 158 or later.