Chrome and Firefox Patch Dozens of Vulnerabilities, Including Two Critical Chrome Flaws

Google and Mozilla shipped browser updates on Tuesday that close out dozens of security vulnerabilities between them, including two critical use-after-free bugs in Chrome and a pair of sandbox escapes in Firefox, SecurityWeek first reported. Neither company has said any of the flaws are being exploited in the wild.

Chrome 152 fixes two critical use-after-free bugs

Chrome 152.0.7977.75/.76 for Windows and macOS, and 152.0.7977.75 for Linux, patches 26 vulnerabilities in total. The two rated critical are both use-after-free flaws: CVE-2026-84353 in Shared Tab Groups and CVE-2026-84352 in WebGL, the component Chrome uses to render interactive 2D and 3D graphics for web pages. A use-after-free bug happens when code keeps using a piece of memory after that memory has already been freed; if an attacker can control what gets written into the freed space before the browser touches it again, the result can range from a crash to arbitrary code execution inside the browser process.

The update also fixes nine high-severity issues, among them an incorrect-authorization flaw in FileSystem (CVE-2026-84354), an information leak in the Skia graphics library (CVE-2026-84359), an improper input-validation bug in the Omnibox (CVE-2026-84357), and three more use-after-free bugs spread across the Proxy, Browser, and Dawn (Chrome’s WebGPU implementation) components. The remaining 15 fixes cover medium- and low-severity issues in areas including WebRTC, Downloads, Autofill, and TabStrip, per a full CVE-by-CVE breakdown independently compiled by Cyber Security News. SecurityWeek reports that, per Google’s own advisory, only three of the 26 bugs were reported by external researchers; most of the rest turned up internally, where Google relies on fuzzing and sanitizer tooling such as AddressSanitizer, MemorySanitizer, and libFuzzer to catch bugs before they reach the Stable channel.

Firefox 155 closes two sandbox escapes

Mozilla’s Firefox 155, detailed in security advisory MFSA 2026-82, fixes 29 vulnerabilities: 13 rated high severity, seven moderate, and nine low. Two of the high-severity bugs are sandbox escapes, meaning a successful exploit would let attacker-controlled web content break out of the restricted process Firefox normally confines it to and reach the rest of the operating system: CVE-2026-84119, a use-after-free in DOM Navigation, and CVE-2026-84121, a use-after-free in DOM Security. Both were reported by the same researcher, Yaqoub Aldurayhim, who is also credited with a third high-severity bug in this release, CVE-2026-84123, a privilege-escalation flaw reached through a use-after-free in WebGPU.

The rest of Firefox’s high-severity fixes cover use-after-free issues in the JavaScript garbage collector and in audio, video, and DOM handling, plus a boundary-condition bug in the CSS Grid layout engine and three memory-corruption issues Mozilla’s own fuzzing team caught before release. Mozilla shipped the same fixes across its extended support releases, Firefox ESR 115.40, ESR 140.15, and ESR 153.2, and in Thunderbird 155, 140.15, and 153.2.

Why browsers keep shipping dozens of fixes at once

Neither release total is unusual for a modern browser. Chrome and Firefox are both large, decades-old C++ codebases whose entire job is to render untrusted content from the open web, which makes memory-safety bug classes like use-after-free and buffer overflows a recurring line item rather than a one-off scandal. Both vendors lean heavily on automated fuzzing and sanitizer tooling to catch the majority of these bugs before release, which is also why most of each update’s fixes come from internal discovery rather than external bug bounty reports.

The flaws worth paying closer attention to are the sandbox escapes and the critical-rated use-after-free bugs, since those are the building blocks an attacker needs to go from a malicious web page to code running with real privileges on the host machine. That two Firefox sandbox escapes and both of Chrome’s critical flaws were caught and fixed before public disclosure, with no in-the-wild exploitation cited by either vendor, is the outcome this kind of pre-release testing exists to produce.

How to update

Chrome updates automatically in the background on most systems; users can force the check from the browser’s menu under Help, About Google Chrome, which downloads and applies version 152.0.7977.75 or later and prompts a relaunch. Firefox works the same way through its own Help, About Firefox panel. Organizations managing browsers through enterprise policy should confirm managed endpoints have actually picked up Chrome 152.0.7977.75 or later and Firefox 155 (or the matching ESR builds), since both vendors are rolling these updates out gradually over the coming days and weeks rather than pushing them to every device at once.