Enterprise Browser Security Updates: Chrome 155 and Firefox 158

Google and Mozilla released browser updates on October 13, 2026, that fix 114 vulnerabilities combined. Google patched 37 flaws in Chrome 155, and Mozilla patched 77 in Firefox 158. These enterprise browser security updates give IT teams a clear reason to audit installed versions across managed desktops.

Chrome’s release carries four critical memory-safety flaws. Neither Google’s release notes nor Mozilla’s advisory mentions active exploitation.

The operational question is whether every desktop has installed these fixes and relaunched its browser. Google says Chrome’s build will roll out over the coming days and weeks, so timing will vary.

Chrome’s Four Critical Flaws Hit Four Different Components

Google’s post says it may restrict bug details until most users update. The reviewed sources do not describe an exploitation chain.

Chrome’s High-Rated Flaws Reach Credentials, Updaters, and V8

The 29 high-rated flaws span several classes:

• Credentials: information leak in Passwords (CVE-2026-110146) and use-after-free flaws in Passwords (CVE-2026-110158, CVE-2026-110145).
• Update path: privilege elevation in Installer (CVE-2026-110150) and incorrect authorization in Updater (CVE-2026-110159).
• Authorization logic: incorrect authorization in Mojo (CVE-2026-110144), missing authorization in ReadingMode (CVE-2026-110160), and incorrect reference resolution in Extensions (CVE-2026-110156).
• V8: type confusion (CVE-2026-110140) and use-after-free flaws (CVE-2026-110169, CVE-2026-110168).
• Native libraries: buffer overflows in Animation (CVE-2026-110166) and PDFium (CVE-2026-110155), and an uninitialized variable in the third-party lmza_sdk component (CVE-2026-110143).
• Everything else: 14 use-after-free flaws across WebRTC, Media, DOM, Canvas, SVG, PDF, ShapeDetection, Bindings, and Desktop, plus an observable discrepancy in Media (CVE-2026-110141).

The single medium flaw is a use-after-free in FileSystem (CVE-2026-110142). The reviewed sources do not detail attack conditions for the Installer, Updater, or authorization flaws.

Firefox 158 Counts 77 CVEs Under a New Advisory Format

Mozilla’s advisory rates its overall impact as high. Mozilla stated it no longer rolls internally identified memory-safety bugs into one CVE. It now issues a separate entry for each bug, so teams should not compare the 77 count with earlier releases.

• Sandbox escapes: eight entries, including high-impact flaws in Networking (CVE-2026-109705, CVE-2026-109707, CVE-2026-109708) and Graphics (CVE-2026-109712).
• JavaScript engine and JIT: seven high-impact entries, including JIT miscompilation flaws (CVE-2026-109720, CVE-2026-109722, CVE-2026-109733).
• Update component: high-impact privilege escalation in Application Update (CVE-2026-109704).
• Enterprise Policies: three moderate mitigation bypasses (CVE-2026-109737, CVE-2026-109764, CVE-2026-109766). Mozilla’s advisory gives no further detail.

Mozilla’s CVE records show some fixes also shipped in Firefox ESR 153.5 and ESR 115.43.

Version Targets for Managed Desktops

• Chrome: 155.0.8059.79 or .80 on Windows and macOS (Google lists both), and 155.0.8059.79 on Linux.
• Older builds: Google’s changelog measures this release against 155.0.8059.40, so that build and anything older lacks the fixes.
• Chrome Extended Stable: Google published a separate desktop update on October 13, so verify that channel separately.
• Firefox: 158. Firefox ESR: 153.5 or 115.43.

Staging Browser Patches With Hexnode UEM

Hexnode UEM can stage third-party app updates through its Winget integration. Confirm in your console that the specific browser titles and versions are listed. It complements the Google and Mozilla fixes and does not replace them.

Catalog and install method

Hexnode documents a typical three-to-five business-day catalog window after vendor release. For manual patch deployment, Hexnode Store updates apply to apps installed through the Hexnode Store, so confirm the catalog listing and your install method.

Windows App Updates policy

Set a maintenance window of at least four hours and choose all Hexnode Store apps or only targeted ones. A Target Version caps updates, so confirm none holds Chrome or Firefox below the fixed build. A device that misses its window waits for the next one.

Windows manual patch deployment

The Automate tab offers Download and Install actions for Hexnode Store apps, pre- and post-install scripts, retries, and included or excluded groups. Success criteria can check script output, app identifier, file path, or registry path on devices with the latest agent.

Approval and automation

Auto patch rules for apps filter on release date and severity. Admins can require update approval and override maintenance windows for downloads, installs, or restarts.

Verification

Run Scan for Updates, then check Patches and Updates in Device details. Status reads Installable or Installed. Patch reports list missing and installed devices with a compliance percentage.

macOS and Linux

The macOS App Updates policy covers VPP apps, while the Hexnode Store also provides a curated library of macOS enterprise binaries for deployment, extending app management beyond VPP. The macOS manual patch automation also lists Hexnode Store apps. Linux patch automations filter by product, severity, classification, or name, so confirm the browser packages appear.

Featured resource

Cybersecurity kit

Download the cybersecurity kit: blueprint, framework guide, admin checklist, incident policy template, and UEM infographic.

DOWNLOAD

Conclusion

These enterprise browser security updates make version verification the immediate priority. Chrome’s four critical flaws and Firefox’s 77 CVEs justify an immediate inventory check.

Confirm fixed versions, pilot catalog patches where available, and track pending devices until each reports the new build. Public reporting does not confirm exploitation, but exposure continues on every lagging device.