Chrome and Firefox Fix 115 Security Flaws in Back-to-Back Updates
Google and Mozilla have each pushed out new browser versions carrying fixes for dozens of vulnerabilities, three of them rated critical in Chrome. Neither company has seen any of the flaws used in real attacks, but the advice is the same: update now.
Key points
- Google released Chrome 153, patching 42 vulnerabilities including three rated critical.
- Mozilla released Firefox 156, fixing 73 vulnerabilities, 29 of them high-severity.
- The two critical Chrome CVEs tagged as use-after-free are CVE-2026-91721 and CVE-2026-91749; the third, CVE-2026-91726, is an out-of-bounds read in WebGL.
- Neither Google nor Mozilla reports any of these flaws being exploited in the wild.
- Firefox 156 fixes also extend to Thunderbird 156 and 140.16, plus Firefox ESR versions 153.3, 140.16 and 115.41.
Google and Mozilla dropped browser updates on the same wave this week, patching a combined 115 vulnerabilities across Chrome and Firefox.
What did attackers find in Chrome?
Nothing yet, publicly. CVE-2026-91721 and CVE-2026-91749 are use-after-free bugs, meaning the browser tries to use a piece of computer memory it has already released, which can let an outside program take control. CVE-2026-91726 is an out-of-bounds read in WebGL, Chrome's 3D graphics layer, meaning the browser can be tricked into reading data from memory it was never supposed to touch.
Chrome 153 also fixes 28 high-severity flaws covering race conditions (two processes collide and behave unpredictably), integer overflows (calculations that produce wrong numbers the software trusts), and incorrect authorization checks. Sixteen of the 42 fixes came from outside researchers. Google has disclosed only two bounty payments totalling $2,500 so far, with 14 amounts still unpublished. We covered the previous Chrome release on 26 August in Chrome 152 Patches 327 Security Flaws, Most Found by Google's Own AI; that batch was far larger, but none of those flaws carried the critical tag these three do.
The updated Chrome versions are 153.0.8010.47/48 on Windows and macOS, and 153.0.8010.47 on Linux.
What changed in Firefox 156?
Firefox 156 carries 73 fixes, more than double Chrome's count, though context matters. Mozilla changed how it counts: rather than grouping internally found memory bugs under a single tracking number, Firefox 156 lists each bug individually. That bookkeeping shift accounts for a large share of the larger number.
The high-severity fixes cover use-after-free flaws, privilege escalation bugs (where a low-permission process gains higher control than it should), sandbox escapes (where code running in an isolated area breaks out to affect the wider system), and site-isolation weaknesses. The same fixes roll into Thunderbird 156 and 140.16, and into Firefox ESR 115.41, 140.16 and 153.3.
| Browser / App | New Version | Vulnerabilities Fixed | Critical |
|---|---|---|---|
| Chrome (Windows/macOS) | 153.0.8010.47/48 | 42 | 3 |
| Chrome (Linux) | 153.0.8010.47 | 42 | 3 |
| Firefox | 156 | 73 | 0 disclosed |
| Thunderbird | 156, 140.16 | Subset of above | |
| Firefox ESR | 153.3, 140.16, 115.41 | Subset of above |
Neither company has flagged any of these flaws as actively exploited. Once a patch ships, though, the flaw's existence becomes public knowledge, and criminals reverse-engineer patches quickly to build exploits targeting anyone who hasn't updated yet. The window between release and criminal use keeps narrowing. Update today.
