Google and Mozilla patch 219 flaws in Chrome 156 and Firefox 159, including four critical Chrome bugs; no exploitation reported
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 30/10/2026 00:10; os links antigos trazem para cá.
Fontes: zdnet.com ↗ securityweek.com ↗
Google released Chrome 156 (156.0.8078.73/.74 on Windows and macOS, 156.0.8078.73 on Linux) with fixes for 52 security defects, four of them critical and 46 high severity (securityweek.com, zdnet.com). Mozilla shipped Firefox 159 with fixes for 167 defects, 108 of them high severity (securityweek.com, zdnet.com). Together the two updates resolve 219 flaws (zdnet.com), and neither vendor nor either source reports in-the-wild exploitation. Many of the findings were credited to AI-assisted research: Mozilla cited Amy Burnett of OpenAI, and Google credited Anthropic's Claude and OpenAI (zdnet.com). Most of Chrome's 39 vulnerabilities with no bounty were found internally or with AI assistance (securityweek.com). Users and administrators are urged to update promptly.
Entenda a falha
A vulnerabilidade
Chrome 156 fixes 52 flaws, four critical: memory corruption in FileSystem (CVE-2026-118306), improper input validation in FileAPI and Skia, and use-after-free in Layout. CVE-2026-118306 could allow arbitrary code execution outside the sandbox through a crafted HTML page, so the attacker needs the victim to load that page. The other critical bugs have no CVE IDs in the articles. Chrome also has 46 high-severity fixes, mostly memory corruption, input validation and use-after-free. Firefox 159 fixes 167 flaws, 108 of them high, mostly use-after-free, plus sandbox escape, privilege escalation, incorrect boundary and same-origin policy bypass bugs. Affected: Chrome before 156.0.8078.73, Firefox before 159, Firefox ESR before 153.6 and 115.44, Thunderbird before 159 and 153.6. No exploitation in the wild is reported.
Como funciona
The articles do not describe individual code paths. For CVE-2026-118306, a crafted HTML page is processed by the browser's FileSystem component, memory is corrupted, and code can then run outside the sandbox, the restricted area where web content normally runs. In a use-after-free, the browser keeps using memory after releasing it, so an attacker who controls what later occupies that memory can crash the browser or steer its execution. The Firefox sandbox-related bugs are described as letting code break out of that restricted area.
Por que é vulnerável
Most of the flaws come from memory-management errors: use-after-free in Firefox and in Chrome's Layout, and memory corruption in Chrome's FileSystem. Two critical Chrome bugs (FileAPI and Skia) are improper input validation, meaning input is not checked properly before use. The sandbox issues are weaknesses that let code cross the isolation boundary. The articles do not explain why each bug went unnoticed or give per-bug fix details; the fix is the updated builds.
Onde está
The articles name only Chrome components, not files or functions: FileSystem (CVE-2026-118306), FileAPI, Skia and Layout; for Firefox no component is named.
Como foi descoberta
Many findings were credited to AI-assisted research. Mozilla's advisory cited Amy Burnett, a security researcher and analyst at OpenAI, for many of the bugs, and Google's blog post attributed several Chrome flaws to Anthropic's Claude and a few to OpenAI. Google has not yet set bug bounty rewards for the reported bugs and will pay none for 39 of the vulnerabilities, most of which were found internally or with AI help. The fixes shipped in the regular Chrome 156 and Firefox 159 releases. The articles do not say when the bugs were reported or whether they had been seen before.
Explicação gerada por IA a partir da matéria e dos artigos, em 30/10/2026 00:25.
Detalhes técnicos
- Chrome critical flaws: memory corruption in FileSystem, improper input validation in FileAPI and Skia, and use-after-free in Layout (securityweek.com).
- CVE-2026-118306 (FileSystem) could allow arbitrary code execution outside the sandbox through a crafted HTML page (securityweek.com).
- Chrome high severity: 46 fixes, mostly memory corruption, improper input validation and use-after-free (securityweek.com, zdnet.com).
- Firefox 159: mostly use-after-free (UAF) issues, nearly 100 by zdnet.com's count. These could let an attacker crash the browser or execute malicious code (zdnet.com). Fixes also cover multiple sandbox escape, privilege escalation, incorrect boundary and same-origin policy bypass bugs (securityweek.com, zdnet.com).
- Mozilla also released Thunderbird 159 and 153.6, and Firefox ESR 153.6 and 115.44, with fixes for many of these flaws (securityweek.com).
Remediação
- Update Chrome to 156.0.8078.73/.74 (Windows and macOS) or 156.0.8078.73 (Linux). Use menu → Help → About Google Chrome, then restart (securityweek.com, zdnet.com).
- Update Firefox to 159, Firefox ESR to 153.6 or 115.44, and Thunderbird to 159 or 153.6. For Firefox, use menu → Help → About Firefox, then restart (securityweek.com, zdnet.com).
- Prioritize fleet-wide browser updates given the volume of memory-safety and sandbox-escape fixes (zdnet.com).
Relatos divergentes
- Chrome critical bugs: securityweek.com lists the specific classes (memory corruption, input validation, use-after-free). zdnet.com describes them more generally as memory corruption and sandbox bypass leading to code execution. The securityweek.com breakdown is more detailed, and the two are not necessarily incompatible.
- Firefox UAF count: securityweek.com says only that the fixes are mostly UAF. zdnet.com gives a figure of nearly 100.
Linha do tempo
-
Firefox 159 and Chrome 156 patch 219 combined security flaws, including sandbox escapes and use-after-free bugs
ler a análise desta fonte ocultar
Mozilla released Firefox 159 for Windows, Android, macOS and Linux, fixing 167 security vulnerabilities, 108 of them rated high severity. Nearly 100 of the issues are use-after-free (UAF) memory management flaws that could let an attacker crash the browser or execute malicious code, and several affect the Firefox sandbox, potentially enabling sandbox escape. Google shipped Chrome 156.0.8078.73/.74 (Windows/Mac) and 156.0.8078.73 (Linux), addressing 52 flaws, four rated critical and 46 high. The four critical bugs involve memory corruption and sandbox bypass leading to code execution. No in-the-wild exploitation is reported in the article; notably, many findings were credited to AI-assisted research, with Mozilla citing Amy Burnett of OpenAI and Google crediting Anthropic's Claude and OpenAI.
Technical Details
- Firefox 159: 167 CVEs-worth of fixes, 108 high severity; ~100 use-after-free issues; multiple sandbox-related bugs permitting escape and code execution.
- Chrome 156: 52 fixes, 4 critical memory corruption/sandbox bypass issues, 46 high severity including UAF flaws.
Remediation
- Update Firefox via menu → Help → About Firefox, then restart.
- Update Chrome via menu → Help → About Google Chrome, then restart.
- Prioritize fleet-wide browser updates given the volume of memory-safety and sandbox-escape fixes.
-
Google and Mozilla patch over 200 vulnerabilities in Chrome 156 and Firefox 159, none reported as exploited
ler a análise desta fonte ocultar
Google released Chrome 156 with fixes for 52 security defects, including four critical-severity flaws, while Mozilla shipped Firefox 159 with patches for 167 defects, 108 of them high severity. Together the updates resolve more than 200 vulnerabilities. Neither vendor reports in-the-wild exploitation, but users are urged to update promptly.
Technical Details
- Chrome critical flaws: memory corruption in FileSystem, improper input validation in FileAPI and Skia, and use-after-free in Layout.
- CVE-2026-118306 (FileSystem) could allow arbitrary code execution outside the sandbox through a crafted HTML page.
- Chrome also received 46 high-severity fixes, mostly memory corruption, improper input validation and use-after-free issues. Most of the 39 vulnerabilities with no bounty were found internally or with AI assistance.
- Firefox 159 fixes are mostly use-after-free issues, plus multiple sandbox escape, privilege escalation, incorrect boundary and same-origin policy bypass bugs.
- Mozilla also released Thunderbird 159 and 153.6, and Firefox ESR 153.6 and 115.44, with fixes for many of these flaws.
Remediation
- Update Chrome to 156.0.8078.73/.74 (Windows and macOS) or 156.0.8078.73 (Linux).
- Update Firefox to 159, Firefox ESR to 153.6 or 115.44, and Thunderbird to 159 or 153.6.