Google Chrome and Mozilla Firefox Release Updates Patching Over 180 Security Vulnerabilities
Google and Mozilla have released security updates for Chrome and Firefox that collectively address over 180 vulnerabilities of varying severity. Chrome version 157.0.8103.78/.79 fixes 83 security defects, including five critical use-after-free vulnerabilities across key components such as ServiceWorker and CSS. Most other Chrome flaws are high severity, including use-after-free, out-of-bounds read/write, and type confusion. Mozilla's Firefox 160 update patches 99 vulnerabilities, with 57 rated high severity involving use-after-free, sandbox escape, and other critical bugs. Thunderbird 160 and Firefox ESR versions have also been updated with numerous fixes. Neither vendor has reported exploitation of these vulnerabilities in the wild yet. Google credited internal researchers and external contributors from Anthropic and OpenAI for reporting many of these issues, and has issued at least one bounty payment.
Entenda a falha
A vulnerabilidade
This is a batch of fixes with no CVEs listed in the story. Chrome 157.0.8103.78/.79 (Windows and macOS) and 157.0.8103.78 (Linux) fix 83 security defects. Five are critical use-after-free bugs in ServiceWorker, CSS, Layout, Skia and Accessibility. The other 78 are high severity: mostly use-after-free (24), out-of-bounds read/write (10), type confusion (9), uninitialized resource (9) and incorrect or missing authorization (8). Firefox 160 patches 99 flaws, 57 of them high severity, mostly use-after-free, incorrect boundary and sandbox escape, plus invalid pointer, privilege escalation, information disclosure and same-origin policy bypass. Thunderbird 160 (103 fixes), Thunderbird 153.7, Firefox ESR 153.7 and ESR 115.45 also received patches. The articles give no attacker prerequisites per flaw.
Como funciona
The articles do not describe the mechanism of any individual flaw. In general terms, the bug classes listed arise when a browser component handles web content, such as scripts, styles, page layout or graphics, and then touches memory that was already freed, reads or writes outside a buffer, or treats an object as the wrong type. Sandbox escape and same-origin bypass bugs mean a check meant to separate content from the rest of the system or from other sites fails.
Por que é vulnerável
The articles do not give root causes for specific bugs. They only name the weakness classes: use-after-free, out-of-bounds read/write, type confusion, uninitialized resources, incorrect or missing authorization, invalid pointers and incorrect boundary handling. The fix is the vendors' updated releases, and the articles do not detail what each patch changes.
Como foi descoberta
According to SecurityWeek, Google found 52 of the Chrome vulnerabilities internally, and researchers from Anthropic and OpenAI reported 18 more. Google paid a $4,000 bug bounty for a high-severity use-after-free in V8 and has not yet set rewards for the remaining 12 externally reported flaws. The articles do not say how Mozilla's bugs were found. Neither Google nor Mozilla mentions exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 11:16.
Linha do tempo
-
Google Chrome and Mozilla Firefox Release Updates Patching Over 180 Security Vulnerabilities
ler a análise desta fonte ocultar
Google and Mozilla have released security updates for Chrome and Firefox that collectively address over 180 vulnerabilities of varying severity. Chrome version 157.0.8103.78/.79 fixes 83 security defects, including five critical use-after-free vulnerabilities across key components such as ServiceWorker and CSS. Most other Chrome flaws are high severity, including use-after-free, out-of-bounds read/write, and type confusion. Mozilla's Firefox 160 update patches 99 vulnerabilities, with 57 rated high severity involving use-after-free, sandbox escape, and other critical bugs. Thunderbird 160 and Firefox ESR versions have also been updated with numerous fixes. Neither vendor has reported exploitation of these vulnerabilities in the wild yet. Google credited internal researchers and external contributors from Anthropic and OpenAI for reporting many of these issues, and has issued at least one bounty payment.