Google and Mozilla on Tuesday announced fresh Chrome and Firefox updates that resolve 114 vulnerabilities.
The Chrome update was rolled out with fixes for 37 security defects, including seven critical-severity memory issues: a buffer overflow in ANGLE and six use-after-free issues in Browser, PDF, Network, Core, SVG, and Media.
Use-after-free weaknesses represented the majority of the 29 high-severity bugs addressed with the browser refresh. The single medium-severity flaw on the list is also a use-after-free bug.
Per Google’s advisory, at least 15 of the vulnerabilities were reported by Xinyang Ge (Anthropic), assisted by Claude, and no bug bounty reward will be paid for them. Google found 12 security defects.
Google says it handed out $1,000 for a high-severity issue reported by an external researcher, and has yet to disclose the reward amounts for the remaining external reports.
Rolling out as versions 155.0.8059.79/.80 for Windows and macOS, and as version 155.0.8059.79 for Linux, the browser refresh arrived on the same day that Google announced higher bug bounty rewards for some Chrome vulnerabilities.
On Tuesday, Mozilla released Firefox 158 with patches for 77 security defects, most of which were discovered by Mozilla (40) and Amy Burnett of OpenAI (9).
The update resolves 30 high-severity use-after-free, sandbox escape, privilege escalation, information disclosure, incorrect boundary, race condition, JIT miscompilation, and integer overflow bugs.
Additionally, Mozilla rolled out Thunderbird 158 and 153.5, and Firefox ESR 153.5 and 115.43 with patches for many of these issues.
Mozilla unveils Firefox Enterprise
Mozilla on Monday introduced Firefox Enterprise, a browser iteration “built for organizations with strict security, governance, and compliance requirements.”
In addition to the browser, Firefox Enterprise comes with a management console that organizations can deploy on their infrastructure to manage policies, access, data transfers, and AI use.
According to Mozilla, the solution is meant to provide IT and security teams with additional control over the browser environment, data, and infrastructure, while reducing dependence on a single architecture, as it uses the Gecko engine, which is built outside Google and Apple.
“Finally, Firefox Enterprise is built to live alongside the systems that IT operations already use. Keep your identity provider. Keep your SIEM. Keep your MDM. Just add a browser whose management infrastructure you operate, so you decide where data lives and have greater visibility into how it moves,” Mozilla notes.
Related: SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities
Related: Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
Related: Critical SonicWall Vulnerability Exploited Days After Disclosure
Related: Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
