Google and Mozilla patch 219 flaws in Chrome 156 and Firefox 159, including four critical Chrome bugs; no exploitation reported
Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 02/11/2026 00:01; os links antigos trazem para cá.
Google released Chrome 156 (156.0.8078.73/.74 on Windows and macOS, 156.0.8078.73 on Linux) on October 27 with fixes for 52 security defects, four of them critical and 46 high severity (securityweek.com, zdnet.com, malwarebytes.com). The same day Mozilla shipped Firefox 159 with fixes for 167 defects, 108 of them high severity (securityweek.com, zdnet.com), published as Security Advisory 2026-118 (malwarebytes.com). Together the two updates resolve 219 flaws (zdnet.com), and neither vendor nor any source reports in-the-wild exploitation. Many of the findings were credited to AI-assisted research: Mozilla cited Amy Burnett of OpenAI, and Google credited Anthropic's Claude and OpenAI (zdnet.com); malwarebytes.com adds that both Google and Mozilla credit OpenAI Codex Security with finding bugs fixed in these releases. Most of Chrome's 39 vulnerabilities with no bounty were found internally or with AI assistance (securityweek.com). Users and administrators are urged to update promptly.
Entenda a falha
A vulnerabilidade
Chrome 156 (156.0.8078.73/.74 on Windows and macOS, 156.0.8078.73 on Linux) fixes 52 flaws: 4 critical and 46 high. The critical ones are memory corruption in FileSystem (CVE-2026-118306), improper input validation in FileAPI and Skia, and use-after-free in Layout. SecurityWeek says CVE-2026-118306 could allow arbitrary code execution outside the sandbox through a crafted HTML page, so the attacker needs the victim to load that page. Firefox 159 (Advisory 2026-118) fixes 167 flaws, 108 of them high, mostly use-after-free, plus sandbox escape, privilege escalation, incorrect boundary and same-origin policy bypass. Firefox ESR 153.6 and 115.44 and Thunderbird 159 and 153.6 carry many of the fixes. No exploitation in the wild is reported.
Como funciona
The browser receives web content, such as an HTML page, a script or an SVG image, and its components (FileSystem, FileAPI, Skia, Layout, JavaScript engine) process it using memory they allocate and release. In a use-after-free, an object's memory is freed but the code keeps a reference and uses it later, working on memory that no longer belongs to that object. In the memory corruption and input validation cases, data from the page is handled in a way that lets memory be altered or limits be exceeded. The result can be a crash or code execution, and for the sandbox-related bugs the code can run outside the browser's protected area. The articles do not describe the exact sequence of each bug.
Por que é vulnerável
The dominant root cause is memory-safety errors in browser code that handles web content: objects used after being freed, memory corrupted, and input not properly validated (FileAPI, Skia). Firefox's fixes also include incorrect boundary handling and same-origin policy bypass, which are missing or wrong checks. The articles do not explain why each bug went unnoticed or what each patch changes in the code; they say only that the updates correct these errors.
Onde está
The articles name only components, not files, functions or commits: Chrome's FileSystem, FileAPI, Skia and Layout, and Mozilla's Security Advisory 2026-118 for Firefox.
Como foi descoberta
Google and Mozilla released the fixes on October 27 as normal security updates, and neither reports exploitation in the wild. Many findings came from AI-assisted research: ZDNET says Mozilla's advisory credits Amy Burnett of OpenAI for many bugs, and Google's blog credits Anthropic's Claude for several and OpenAI for a few. Malwarebytes says both vendors credit OpenAI Codex Security, and that Mozilla's collaboration with Anthropic produced bugs researchers validated before reporting, giving Mozilla reproducible cases. SecurityWeek adds that Google has set no bounty yet for some reports and will pay none for 39 vulnerabilities, most found internally or with AI help. The articles do not say which tool found which bug.
Explicação gerada por IA a partir da matéria e dos artigos, em 02/11/2026 00:17.
Detalhes técnicos
- Chrome critical flaws: memory corruption in FileSystem, improper input validation in FileAPI and Skia, and use-after-free in Layout (securityweek.com).
- CVE-2026-118306 (FileSystem) could allow arbitrary code execution outside the sandbox through a crafted HTML page (securityweek.com).
- Chrome high severity: 46 fixes, mostly memory corruption, improper input validation and use-after-free (securityweek.com, zdnet.com).
- Firefox 159: mostly use-after-free (UAF) issues, nearly 100 by zdnet.com's count. These could let an attacker crash the browser or execute malicious code (zdnet.com). Fixes also cover multiple sandbox escape, privilege escalation, incorrect boundary and same-origin policy bypass bugs (securityweek.com, zdnet.com).
- Across both releases, the memory-safety problems include use-after-free bugs in page layout, JavaScript processing and SVG graphics (malwarebytes.com). A use-after-free occurs when a program accesses memory after it has been freed, leading to crashes or, in some cases, attacker code execution (malwarebytes.com).
- Mozilla's separate collaboration with Anthropic produced validated, reproducible AI-discovered bugs (malwarebytes.com).
- Mozilla also released Thunderbird 159 and 153.6, and Firefox ESR 153.6 and 115.44, with fixes for many of these flaws (securityweek.com).
Remediação
- Update Chrome to 156.0.8078.73/.74 (Windows and macOS) or 156.0.8078.73 (Linux). Use menu → Help → About Google Chrome, then restart (securityweek.com, zdnet.com, malwarebytes.com).
- Update Firefox to 159, Firefox ESR to 153.6 or 115.44, and Thunderbird to 159 or 153.6. For Firefox, use menu → Help → About Firefox, then restart (securityweek.com, zdnet.com, malwarebytes.com).
- Restart browsers regularly and check that extensions are not blocking updates (malwarebytes.com).
- Prioritize fleet-wide browser updates given the volume of memory-safety and sandbox-escape fixes (zdnet.com).
Relatos divergentes
- Chrome critical bugs: securityweek.com lists the specific classes (memory corruption, input validation, use-after-free). zdnet.com describes them more generally as memory corruption and sandbox bypass leading to code execution. The securityweek.com breakdown is more detailed, and the two are not necessarily incompatible.
- Firefox UAF count: securityweek.com says only that the fixes are mostly UAF. zdnet.com gives a figure of nearly 100.
- AI credit: zdnet.com attributes the AI-assisted findings to Amy Burnett of OpenAI (Mozilla) and to Anthropic's Claude and OpenAI (Google), while malwarebytes.com names OpenAI Codex Security as credited by both vendors. These may describe different findings and are not necessarily incompatible.
- CVE identifiers: malwarebytes.com does not list CVE identifiers, while securityweek.com cites CVE-2026-118306 for the FileSystem flaw.
Linha do tempo
-
Chrome 156 and Firefox 159 patch 52 and 167 vulnerabilities, including four Critical Chrome flaws
ler a análise desta fonte ocultar
On October 27, Google released a Chrome Stable update (156.0.8078.73/.74 for Windows and Mac, 156.0.8078.73 for Linux) with 52 security fixes, four rated Critical. The same day Mozilla published Security Advisory 2026-118, fixing 167 vulnerabilities, alongside the release of Firefox 159. Both releases address memory-safety problems, including use-after-free bugs in page layout, JavaScript processing and SVG graphics. Google and Mozilla both credit OpenAI Codex Security with finding bugs fixed in these releases. The article does not report active exploitation or list CVE identifiers.
Technical Details
- Use-after-free flaws occur when a program accesses memory after it has been freed, leading to crashes or, in some cases, attacker code execution.
- Affected components include layout, JavaScript processing and SVG graphics.
- Mozilla's separate collaboration with Anthropic produced validated, reproducible AI-discovered bugs.
Remediation
- Update Chrome to 156.0.8078.73/.74 (Windows/Mac) or 156.0.8078.73 (Linux): Settings > About Google Chrome, then Relaunch.
- Update Firefox to 159: Menu > Help > About Firefox, then Relaunch.
- Restart browsers regularly and check that extensions are not blocking updates.
-
Firefox 159 and Chrome 156 patch 219 combined security flaws, including sandbox escapes and use-after-free bugs
ler a análise desta fonte ocultar
Mozilla released Firefox 159 for Windows, Android, macOS and Linux, fixing 167 security vulnerabilities, 108 of them rated high severity. Nearly 100 of the issues are use-after-free (UAF) memory management flaws that could let an attacker crash the browser or execute malicious code, and several affect the Firefox sandbox, potentially enabling sandbox escape. Google shipped Chrome 156.0.8078.73/.74 (Windows/Mac) and 156.0.8078.73 (Linux), addressing 52 flaws, four rated critical and 46 high. The four critical bugs involve memory corruption and sandbox bypass leading to code execution. No in-the-wild exploitation is reported in the article; notably, many findings were credited to AI-assisted research, with Mozilla citing Amy Burnett of OpenAI and Google crediting Anthropic's Claude and OpenAI.
Technical Details
- Firefox 159: 167 CVEs-worth of fixes, 108 high severity; ~100 use-after-free issues; multiple sandbox-related bugs permitting escape and code execution.
- Chrome 156: 52 fixes, 4 critical memory corruption/sandbox bypass issues, 46 high severity including UAF flaws.
Remediation
- Update Firefox via menu → Help → About Firefox, then restart.
- Update Chrome via menu → Help → About Google Chrome, then restart.
- Prioritize fleet-wide browser updates given the volume of memory-safety and sandbox-escape fixes.
-
Google and Mozilla patch over 200 vulnerabilities in Chrome 156 and Firefox 159, none reported as exploited
ler a análise desta fonte ocultar
Google released Chrome 156 with fixes for 52 security defects, including four critical-severity flaws, while Mozilla shipped Firefox 159 with patches for 167 defects, 108 of them high severity. Together the updates resolve more than 200 vulnerabilities. Neither vendor reports in-the-wild exploitation, but users are urged to update promptly.
Technical Details
- Chrome critical flaws: memory corruption in FileSystem, improper input validation in FileAPI and Skia, and use-after-free in Layout.
- CVE-2026-118306 (FileSystem) could allow arbitrary code execution outside the sandbox through a crafted HTML page.
- Chrome also received 46 high-severity fixes, mostly memory corruption, improper input validation and use-after-free issues. Most of the 39 vulnerabilities with no bounty were found internally or with AI assistance.
- Firefox 159 fixes are mostly use-after-free issues, plus multiple sandbox escape, privilege escalation, incorrect boundary and same-origin policy bypass bugs.
- Mozilla also released Thunderbird 159 and 153.6, and Firefox ESR 153.6 and 115.44, with fixes for many of these flaws.
Remediation
- Update Chrome to 156.0.8078.73/.74 (Windows and macOS) or 156.0.8078.73 (Linux).
- Update Firefox to 159, Firefox ESR to 153.6 or 115.44, and Thunderbird to 159 or 153.6.