Chrome and Firefox have received major security updates to address dozens of critical and high-severity vulnerabilities, with use -after-free vulnerabilities dominating the list of fixes. These updates affect hundreds of millions of users worldwide, and security experts recommend immediate installation, as these types of vulnerabilities are often exploited in real-world attacks.
Google Chrome: Fix 33 vulnerabilities
Chrome has been updated to versions 149.0.7827.155/.156 for Windows and macOS and to version 149.0.7827.155 for Linux, fixing 33 security vulnerabilities.
See also: Chrome 134 and Firefox 136 fix critical vulnerabilities
Google 's new advisory lists seven critical vulnerabilities , six of which are use-after-free issues — a type of memory error that can be exploited for remote code execution (RCE) . In Chrome's architecture, these weaknesses can lead to sandbox escape if combined with exploits in the operating system or a privileged browser process.
In addition to the critical vulnerabilities, the new version of Chrome also fixes 26 high-severity vulnerabilities, including eight use-after-free issues, as well as insufficient data validation, inappropriate implementation, out-of-bounds read, incorrect security UI, heap buffer overflow , and uninitialized use.
Google does not report any exploitation of any of these vulnerabilities, however the scale of the update suggests that this is a broad security enhancement rather than an isolated fix.
See also: Chrome 135 and Firefox 137 fix high-severity vulnerabilities
Firefox: Fix 40 vulnerabilities
Firefox 152 was released to the stable channel with fixes for 40 vulnerabilities. Among them are 13 high severityones, including use-after-free, privilege escalation, incorrect boundary condition, sandbox escape, JIT miscompilation , and memory safety bugs.
Mozilla warns that some of the fixed memory errors could potentially be exploited for arbitrary code execution. On the same day, Mozilla also released security updates for Firefox ESR, Thunderbird , and Firefox for iOS, ensuring that all of its users are protected.
See also: Firefox 145 and Chrome 142 fix serious vulnerabilities
The importance of these updates becomes even more apparent when you consider the broader context: use-after-free bugs have been one of the most dangerous classes of vulnerabilities in browsers for years. The combination of “critical” severity and sandbox escape means that an attacker can escape the browser’s restrictions and gain access to the underlying system. This exploitation pattern — combining a browser bug with an OS-level vulnerability — has been seen in many real-world attacks in recent years.
Organizations and individuals should immediately update Chrome and Firefox through their normal software management process, prioritizing high-risk users such as executives, developers, and support staff. It is important to verify that browsers are up-to-date on all endpoints, including laptops and virtual environments. In addition, security teams should increase monitoring for unusual browser crashes, suspicious child-process behavior, and exploit chains that combine browser bugs with OS privilege escalation. Using exploit mitigations such as application allowlisting, reducing local administrator privileges, and fully updating sandbox-related components of the operating system provides an additional layer of protection against these types of attacks.
