Chrome and Firefox patch over 180 security flaws on desktop
Google and Mozilla released desktop updates resolving over 180 security vulnerabilities across Chrome and Firefox. The patches address 83 flaws in Chrome and 99 issues in Firefox.
Contents
Chrome, the world's most actively used web browser, and Firefox, another popular browser, have released an urgent update that directly affects users and fixes hundreds of security vulnerabilities.
The security packages released for both browsers resolve 83 separate flaws in Google Chrome and 99 in Mozilla Firefox. The updates have started rolling out across desktop operating systems.
Five critical vulnerabilities patched with Chrome 157
Google fixed 83 security vulnerabilities in its Chrome update for desktop platforms. Five of these flaws were classified as critical, the highest severity level. All critical bugs consist of memory management use-after-free vulnerabilities, located in the ServiceWorker, CSS, Layout, Skia, and Accessibility components.
The remaining 78 flaws are all rated as high severity. The breakdown of vulnerabilities in this group was recorded as follows:
- 24 use-after-free vulnerabilities
- 10 out-of-bounds read/write errors
- 9 type confusion issues
- 9 uninitialized resource flaws
- 8 incorrect/missing authorization vulnerabilities
52 of the patched vulnerabilities were discovered by Google's own security teams. 18 security vulnerabilities were reported to the company by artificial intelligence (AI) researchers at Anthropic and OpenAI. Google stated that no bug bounties will be paid for internal reports or vulnerabilities submitted by AI labs. The company announced that it awarded a $4,000 bounty for a use-after-free vulnerability discovered in the V8 engine by an external researcher, adding that reward amounts for the remaining 12 external vulnerabilities have not yet been finalized.
The new Chrome version is rolling out under version numbers 157.0.8103.78/.79 for Windows and macOS, and 157.0.8103.78 for Linux.
Patches released for Firefox 160 and Thunderbird versions
Meanwhile, Mozilla also resolved a total of 99 security vulnerabilities, 57 of which are high severity, in the Firefox 160 version released this week. Patched flaws include use-after-free issues, boundary check errors, and sandbox escape vulnerabilities. The update also resolves invalid pointer, privilege escalation, information disclosure, and same-origin policy bypass bugs.
Alongside Firefox, Mozilla released updates for its email client Thunderbird. In addition to Thunderbird 160 containing 103 fixes, Thunderbird 153.7, Firefox ESR 153.7, and Firefox ESR 115.45 were also updated with dozens of security patches.
Summary of versions and security patches
| Software | New Version Number | Number of Patched Vulnerabilities | Critical / High Severity Flaws |
|---|---|---|---|
| Google Chrome | 157.0.8103.78/.79 (Win/Mac), 157.0.8103.78 (Linux) | 83 | 5 critical, 78 high |
| Mozilla Firefox | 160 | 99 | 57 high |
| Mozilla Thunderbird | 160 | 103 | Mostly shared with Firefox 160 |
Status for users
Google and Mozilla stated that there is no evidence indicating that any of the patched vulnerabilities have been actively targeted by cyber attackers. Although not yet used in attacks, browsers must be updated to the latest version to prevent scanning for critical and high-severity flaws.
Users can download and install the updates by opening "Help > About Google Chrome" in Chrome, and "Help > About Firefox" in Firefox.
This article was translated from Turkish. Read the original article in Turkish.
