Chrome, Firefox Fix 115 Security Flaws in Updates

Google and Mozilla released security updates for their browsers that together resolve 115 vulnerabilities. Chrome 153 addresses 42 defects, including three critical bugs, while Firefox 156 fixes 73 vulnerabilities, 29 of them rated high severity.

Chrome 153 includes three critical CVEs: CVE-2026-91726, an out-of-bounds read in WebGL; CVE-2026-91721, a use-after-free issue in Internals; and CVE-2026-91749, a use-after-free in Workers. Google’s advisory lists other resolved weaknesses that include use-after-free, race conditions, type confusion, integer overflow, incorrect authorization and uninitialized resource handling. Sixteen of the patched Chrome issues came from external researchers. Google disclosed two bounty payments totaling $2,500 and has not published amounts for 14 other reports. The update is rolling out as versions 153.0.8010.47 and 153.0.8010.48 for Windows and macOS, and 153.0.8010.47 for Linux.

Firefox 156 fixes 73 vulnerabilities, with 29 rated high severity. Many of the high-severity bugs are use-after-free and privilege escalation issues. The release also closes weaknesses related to sandbox escape, site isolation failures, incorrect boundary conditions and mitigation bypasses. Mozilla’s advisory assigns a separate CVE to each memory-safety bug rather than grouping multiple internal findings under one identifier, which increases the total count. Security updates that address related issues were issued for Thunderbird (156 and 140.16) and for Firefox Extended Support Release versions 153.3, 140.16 and 115.41.

Neither Google nor Mozilla indicated any of the patched vulnerabilities are known to have been exploited in the wild. Both vendors recommend that users install the updates as soon as possible. Chrome users can check the browser’s About page for the new 153.x builds; Firefox users can install the 156 update through the browser’s built-in updater or via their organization’s software distribution tools.

An out-of-bounds read occurs when a program reads memory outside the area it should access. A use-after-free flaw happens when software accesses memory after it has been released. Both are types of memory-safety errors that attackers can exploit to crash software or run code. Race conditions, type confusion and integer overflows are other error categories that can cause incorrect behavior when exploited.

Both vendors issued these fixes as part of their regular maintenance cycles. Organizations that manage many devices should test the updates in a controlled environment and deploy them according to internal update policies. Individual users can apply the patches directly in their browsers to receive the security fixes.