Chrome 156 and Firefox 159 patch 52 and 167 vulnerabilities, including four Critical Chrome flaws
On October 27, Google released a Chrome Stable update (156.0.8078.73/.74 for Windows and Mac, 156.0.8078.73 for Linux) with 52 security fixes, four rated Critical. The same day Mozilla published Security Advisory 2026-118, fixing 167 vulnerabilities, alongside the release of Firefox 159. Both releases address memory-safety problems, including use-after-free bugs in page layout, JavaScript processing and SVG graphics. Google and Mozilla both credit OpenAI Codex Security with finding bugs fixed in these releases. The article does not report active exploitation or list CVE identifiers.
Entenda a falha
A vulnerabilidade
Chrome 156.0.8078.73/.74 (Windows and Mac) and 156.0.8078.73 (Linux) fix 52 security issues, four rated Critical. Firefox 159 fixes 167 vulnerabilities under Mozilla Security Advisory 2026-118. The articles name no CVE IDs and give no per-bug severity, but say both releases fix use-after-free bugs in page layout, JavaScript processing and SVG graphics. Such bugs can cause crashes or, in some cases, let an attacker run their own code. The articles do not say what an attacker needs, but the bugs sit in code that processes web content. Earlier Chrome builds and Firefox versions before 159 are affected. No active exploitation is reported.
Como funciona
The browser receives web content, such as a page, a script or an SVG image, and its layout, JavaScript or graphics code handles it using memory it allocates and releases. In a use-after-free, a piece of that memory is freed, but the code still holds a reference and later accesses it. At that point the program works with memory that no longer belongs to the original object. The result can be a crash or, in some cases, attacker-controlled code execution. The articles do not describe the exact sequence for each individual bug.
Por que é vulnerável
The root cause is browser code mishandling memory while processing web content: objects are accessed after their memory has been freed, which is the memory-safety class known as use-after-free. The articles do not explain why each bug went unnoticed or what each patch changes in the code. They say only that the updates correct these memory-handling errors.
Como foi descoberta
Google and Mozilla both credit OpenAI Codex Security with finding bugs fixed in these releases. The articles describe AI as a help for examining browser code, alongside human code review and automated tests with unexpected inputs. Separately, Mozilla's collaboration with Anthropic produced bugs that researchers validated before reporting, so Mozilla received reproducible cases to investigate and fix. Google and Mozilla released the fixes on October 27, Chrome as a Stable update and Mozilla as Advisory 2026-118 with Firefox 159. The articles do not say which specific bugs each tool found.
Explicação gerada por IA a partir da matéria e dos artigos, em 01/11/2026 22:39.
Detalhes técnicos
- Use-after-free flaws occur when a program accesses memory after it has been freed, leading to crashes or, in some cases, attacker code execution.
- Affected components include layout, JavaScript processing and SVG graphics.
- Mozilla's separate collaboration with Anthropic produced validated, reproducible AI-discovered bugs.
Remediação
- Update Chrome to 156.0.8078.73/.74 (Windows/Mac) or 156.0.8078.73 (Linux): Settings > About Google Chrome, then Relaunch.
- Update Firefox to 159: Menu > Help > About Firefox, then Relaunch.
- Restart browsers regularly and check that extensions are not blocking updates.
Linha do tempo
-
Chrome 156 and Firefox 159 patch 52 and 167 vulnerabilities, including four Critical Chrome flaws
ler a análise desta fonte ocultar
On October 27, Google released a Chrome Stable update (156.0.8078.73/.74 for Windows and Mac, 156.0.8078.73 for Linux) with 52 security fixes, four rated Critical. The same day Mozilla published Security Advisory 2026-118, fixing 167 vulnerabilities, alongside the release of Firefox 159. Both releases address memory-safety problems, including use-after-free bugs in page layout, JavaScript processing and SVG graphics. Google and Mozilla both credit OpenAI Codex Security with finding bugs fixed in these releases. The article does not report active exploitation or list CVE identifiers.
Technical Details
- Use-after-free flaws occur when a program accesses memory after it has been freed, leading to crashes or, in some cases, attacker code execution.
- Affected components include layout, JavaScript processing and SVG graphics.
- Mozilla's separate collaboration with Anthropic produced validated, reproducible AI-discovered bugs.
Remediation
- Update Chrome to 156.0.8078.73/.74 (Windows/Mac) or 156.0.8078.73 (Linux): Settings > About Google Chrome, then Relaunch.
- Update Firefox to 159: Menu > Help > About Firefox, then Relaunch.
- Restart browsers regularly and check that extensions are not blocking updates.