Chrome 157 and Firefox 160 updates patch over 180 vulnerabilities, including five critical Chrome use-after-free flaws
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 13/11/2026 12:07; os links antigos trazem para cá.
Fontes: malwarebytes.com ↗ securityweek.com ↗
On November 11, 2026, Google released a Chrome Stable update for Windows, Mac and Linux, moving it to version 157.0.8103.78/.79 (malwarebytes.com). It fixes 83 security defects, five of them critical use-after-free (UAF) vulnerabilities in components such as ServiceWorker and CSS (securityweek.com, malwarebytes.com). Malwarebytes describes it as the second Chrome security update in a week. Mozilla released Firefox 160 on the same cycle, patching 99 vulnerabilities, 57 of them rated high severity, including use-after-free and sandbox escape bugs. Together the two vendors fixed more than 180 flaws (securityweek.com). Neither vendor has reported exploitation in the wild so far (securityweek.com). Google credited internal researchers and external contributors from Anthropic and OpenAI for many of the reports, and has issued at least one bounty payment (securityweek.com).
Entenda a falha
A vulnerabilidade
The Chrome Stable update of November 11, 2026 fixes 83 security defects. Five are Critical use-after-free flaws in ServiceWorker, CSS, Layout, Skia and Accessibility. The other 78 are High severity: 24 use-after-free, 10 out-of-bounds read/write, 9 type confusion, 9 uninitialized resource and 8 incorrect or missing authorization. Fixed versions are 157.0.8103.78/.79 on Windows and macOS and 157.0.8103.78 on Linux. Firefox 160 fixes 99 flaws, 57 of them High, mostly use-after-free, incorrect boundary and sandbox escape, plus invalid pointer, privilege escalation, information disclosure and same-origin policy bypass. Thunderbird 160 (103 fixes), Firefox ESR 153.7 and ESR 115.45 also received patches. The articles give no CVE IDs and no attack requirements per flaw.
Como funciona
The articles do not describe the code paths of the individual bugs. In a typical use-after-free, the program releases an object's memory but keeps a reference to the old location, a dangling pointer. Later the program uses that reference, although the original object is gone and something else may now occupy that memory. If an attacker can influence what replaces the freed object, the program may treat that data as legitimate data or instructions.
Por que é vulnerável
The articles name the bug classes but not the root cause of each flaw. For use-after-free, Malwarebytes explains it as a mistake in managing how long an object stays available: one part of the program frees it while another still expects to use it. Typical triggers are confused ownership, faulty error handling or timing issues between concurrent tasks. The articles do not say what each fix changes.
Como foi descoberta
According to SecurityWeek, Google found 52 of the Chrome vulnerabilities internally, and researchers from Anthropic and OpenAI reported 18 more. The article says no monetary reward will be paid for these flaws, yet also reports a $4,000 bug bounty for a high-severity use-after-free in V8; amounts for the remaining 12 externally reported flaws are not yet decided. The articles do not say who found the Firefox flaws or how. Neither Google nor Mozilla mentions exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 12:22.
Detalhes técnicos
- Chrome 157.0.8103.78/.79: 83 fixes, five critical UAF flaws; most of the rest are high severity, including use-after-free, out-of-bounds read/write and type confusion (securityweek.com).
- A UAF occurs when software accesses memory that has already been freed. Depending on exploitability and mitigations, this can allow arbitrary code execution or crashes (malwarebytes.com).
- Firefox 160: 99 fixes, 57 of them high severity, including use-after-free and sandbox escape bugs (securityweek.com).
- Thunderbird 160 and the Firefox ESR branches also received numerous fixes (securityweek.com).
- The sources give no CVE identifiers, and no per-bug details beyond the categories above.
Remediação
- Update Chrome to 157.0.8103.78/.79 or later, either through automatic updates or manually via Chrome's About menu (malwarebytes.com).
- Update Firefox to 160, Thunderbird to 160, and Firefox ESR to the latest fixed releases (securityweek.com).
- Restart the browsers after updating so the patched versions take effect.
Linha do tempo
-
Google releases second Chrome update in a week fixing 83 vulnerabilities including 5 critical use-after-free flaws
ler a análise desta fonte ocultar
On November 11, 2026, Google released another security update for the Chrome Stable channel across Windows, Mac, and Linux platforms, advancing versions to 157.0.8103.78/.79. This update addresses 83 security issues, with five critical severity vulnerabilities classified as use-after-free (UAF) flaws. UAF vulnerabilities occur when software accesses memory that has already been freed, potentially allowing attackers to execute arbitrary code or cause crashes depending on exploitability and mitigations. Users are advised to update immediately by allowing automatic updates or manually via Chrome's About menu to mitigate risks associated with these critical flaws. This rapid follow-up patch highlights the ongoing need for vigilance and prompt update adoption in maintaining browser security.
-
Google Chrome and Mozilla Firefox Release Updates Patching Over 180 Security Vulnerabilities
ler a análise desta fonte ocultar
Google and Mozilla have released security updates for Chrome and Firefox that collectively address over 180 vulnerabilities of varying severity. Chrome version 157.0.8103.78/.79 fixes 83 security defects, including five critical use-after-free vulnerabilities across key components such as ServiceWorker and CSS. Most other Chrome flaws are high severity, including use-after-free, out-of-bounds read/write, and type confusion. Mozilla's Firefox 160 update patches 99 vulnerabilities, with 57 rated high severity involving use-after-free, sandbox escape, and other critical bugs. Thunderbird 160 and Firefox ESR versions have also been updated with numerous fixes. Neither vendor has reported exploitation of these vulnerabilities in the wild yet. Google credited internal researchers and external contributors from Anthropic and OpenAI for reporting many of these issues, and has issued at least one bounty payment.