Google and Mozilla have released fresh Chrome and Firefox security updates that resolve more than 180 vulnerabilities.
The Chrome refresh fixes 83 security defects, including five critical-severity use-after-free issues in ServiceWorker, CSS, Layout, Skia, and Accessibility.
All the remaining 78 bugs are high-severity weaknesses, mostly use-after-free (24), out-of-bounds read/write (10), type confusion (9), uninitialized resource (9), and incorrect/missing authorization (8).
Google discovered 52 of the vulnerabilities internally, and Anthropic and OpenAI researchers reported 18 more. No monetary reward will be handed out for any of these flaws.
The internet giant has paid a $4,000 bug bounty reward for a high-severity use-after-free in V8, but has not determined the amounts to be handed out for the remaining 12 externally reported flaws.
The latest Chrome iteration is now rolling out as versions 157.0.8103.78/.79 for Windows and macOS, and as version 157.0.8103.78 for Linux.
Firefox 160 arrived this week with patches for 99 vulnerabilities, including 57 high-severity security weaknesses.
Most of the flaws are use-after-free, incorrect boundary, and sandbox escape issues. The browser refresh also resolved invalid pointer, privilege escalation, information disclosure, and same-origin policy bypass bugs.
Mozilla included patches for most of these security defects in Thunderbird 160, which landed this week with 103 fixes. Thunderbird 153.7, Firefox ESR 153.7, and Firefox ESR 115.45 also rolled out with dozens of vulnerability patches.
Google and Mozilla make no mention of any of these vulnerabilities being exploited in the wild.
Related: Chrome Update Patches Exploited XML Zero-Day, Eighth This Year
Related: Hackers Target N-central Zero-Days as N-able Rushes Patches
Related: Critical Red Hat Quay Vulnerability Could Expose Private Container Images
Related: Critical Xen Orchestra Flaws Exploited in Attacks
