Google and Mozilla on Tuesday announced fresh Chrome and Firefox updates that resolve 114 vulnerabilities.
The Chrome update was rolled out with fixes for 37 security defects, including seven critical-severity memory issues: a buffer overflow in ANGLE and six use-after-free issues in Browser, PDF, Network, Core, SVG, and Media.
Use-after-free weaknesses represented the majority of the 29 high-severity bugs addressed with the browser refresh. The single medium-severity flaw on the list is also a use-after-free bug.
Per Google’s advisory, at least 15 of the vulnerabilities were reported by Xinyang Ge (Anthropic), assisted by Claude, and no bug bounty reward will be paid for them. Google found 12 security defects.
Google says it handed out $1,000 for a high-severity issue reported by an external researcher, and has yet to disclose the reward amounts for the remaining external reports.
Rolling out as versions 155.0.8059.79/.80 for Windows and macOS, and as version 155.0.8059.79 for Linux, the browser refresh arrived on the same day that Google announced higher bug bounty rewards for some Chrome vulnerabilities.
On Tuesday, Mozilla released Firefox 158 with patches for 77 security defects, most of which were discovered by Mozilla (40) and Amy Burnett of OpenAI (9).
The update resolves 30 high-severity use-after-free, sandbox escape, privilege escalation, information disclosure, incorrect boundary, race condition, JIT miscompilation, and integer overflow bugs.