Firefox and Chrome Rush Out Patches for Dozens of Security Flaws
Mozilla fixed 58 vulnerabilities in Firefox 154, while Google addressed 15 in Chrome 151, including two critical bugs that could let attackers run malicious code on your device.
Key points
- Firefox 154, released Tuesday, patches 58 security flaws, 20 of them rated high-severity.
- Two critical-severity buffer overflow bugs (a type of flaw where attackers stuff too much data into a program's memory to hijack it) were fixed in Chrome 151.
- Mozilla also shipped Thunderbird 154 with fixes for 55 separate vulnerabilities on the same day.
- Google found 11 of Chrome's 15 flaws itself; four were reported by outside researchers.
- Windows, macOS, and Linux users all received Chrome 151 in this update cycle.
What happened?
Both Google and Mozilla pushed security updates on Tuesday, closing dozens of holes in their browsers before criminals could use them. For ordinary people, the short version is this: unpatched, some of these flaws could let a bad actor take control of your computer simply by getting you to visit a malicious website.
Mozilla's Firefox 154 arrived with patches for 58 CVEs, which stands for Common Vulnerabilities and Exposures, the standard system used to label and track publicly known security flaws. Twenty of those carry a high-severity rating. Roughly half are memory safety bugs, meaning flaws in how the browser handles data in your computer's memory, which attackers can exploit to run their own code on your machine.
The breakdown is notable. Six "use-after-free" bugs (where the program keeps using a chunk of memory it already discarded, creating an opening for attack), six privilege escalation flaws (letting attackers gain more control over a system than they should have), two information disclosure issues, one sandbox escape, and one site isolation problem were all resolved in a single drop.
Mozilla also released Thunderbird 154, its email client, with fixes for 55 vulnerabilities. Extended support versions of both Firefox and Thunderbird received patches on the same day.
How serious are the Chrome flaws?
Two of Chrome's 15 patched bugs are rated critical, the most serious category. Both are buffer overflow vulnerabilities in components called WebGL and Dawn, which handle the graphics your browser renders. A critical buffer overflow could, in a worst case, let an attacker run any code they like on your device.
The remaining 13 Chrome flaws are rated high-severity, covering a range of issue types including race conditions (where two processes trip over each other in a way attackers can exploit) and type confusion bugs (where the program misidentifies what kind of data it is handling). Google says it discovered 11 of the 15 flaws through its own internal security work.
Chrome 151 is rolling out now as versions 151.0.7922.169 and 151.0.7922.170 for Windows and macOS, and 151.0.7922.169 for Linux.
| Browser / App | New Version | Vulnerabilities Patched | Highest Severity |
|---|---|---|---|
| Firefox | 154 | 58 | Critical |
| Thunderbird | 154 | 55 | High |
| Chrome | 151 | 15 | Critical |
| Firefox ESR | 115.39 / 140.14 / 153.1 | Multiple | High |
| Thunderbird ESR | 140.14 / 153.1 | Multiple | High |
Should ordinary users do anything?
Yes, one thing: update now. Both browsers can do this automatically, but it pays to check. In Chrome, click the three-dot menu in the top-right corner, choose Help, then "About Google Chrome". In Firefox, go to the menu, click Help, then "About Firefox". If an update is waiting, it will install in seconds.
If you use Thunderbird for email, the same principle applies. Open the Help menu and check for updates. SecurityWeek first reported the details of both advisories.
