Chrome 150, Firefox 152 patch critical browser flaws

Google and Mozilla released updates for Chrome and Firefox that fix multiple security flaws, including several rated critical. The Chrome 150 update is rolling out in desktop builds while Mozilla pushed Firefox 152.0.6.

Mozilla issued Firefox 152.0.6 to address two critical defects tracked as CVE-2026-15718 and CVE-2026-15719. CVE-2026-15718 is an invalid pointer error in the JavaScript: WebAssembly component and CVE-2026-15719 affects site isolation in the DOM: Navigation component. Mozilla noted, “We are aware that exploit code for this is public however we are not aware of any attacks in the wild.” Mozilla recommends users update to 152.0.6 to receive the fixes.

Google’s Chrome 150 release, rolling out as versions 150.0.7871.124 and 150.0.7871.125 for Windows and macOS and 150.0.7871.124 for Linux, fixes 15 security vulnerabilities. Two of those are critical use-after-free bugs in the Ozone component, tracked as CVE-2026-15764 and CVE-2026-15765. The update also resolves 12 high-severity bugs across Skia, Libyuv, HTML-in-Canvas, Linux Toolkit Theming, V8, Media, GPU, Core and the browser UI.

The reported defect types include uninitialized use, heap buffer overflow, insufficient policy enforcement, inadequate validation of untrusted input and additional use-after-free conditions. Only three of the Chrome issues were reported by external researchers; the remainder were found by Google’s internal teams. Google has not disclosed any bounty amounts and has not reported observing exploitation of the patched flaws in the wild.

WebAssembly allows browsers to run compiled code at near-native speed, so pointer and memory errors in that area can lead to crashes or code execution if exploited. Site isolation is a mechanism that keeps content from different sites separate; flaws there can weaken those boundaries. Ozone provides graphics and input abstraction on some platforms; use-after-free bugs in Ozone can allow attackers to manipulate memory after an object has been freed.

Both vendors recommend installing the updates as they become available to close the known vulnerabilities.