Chrome and Firefox Fix Critical Memory-Safety and Privilege-Escalation Flaws

Google and Mozilla released major browser security updates to address more than 70 vulnerabilities across Chrome and Firefox, many tied to memory-safety weaknesses that could lead to remote code execution, sandbox escape, or privilege escalation. Chrome 149.0.7827.155/.156 fixes 33 flaws, including seven critical issues and 26 high-severity bugs; six of the critical flaws were reported as use-after-free vulnerabilities. Mozilla issued Firefox 152 along with Firefox ESR 115.37 and 140.12, remediating 40 vulnerabilities affecting areas such as memory corruption, denial of service, spoofing, sensitive information disclosure, and security restriction bypass.

Mozilla highlighted CVE-2026-12304, a same-origin policy bypass in the Networking: Cookies component with a CVSS score of 9.1, and CVE-2026-12289, a privilege-escalation flaw in Graphics: WebRender rated 8.8. Firefox’s fixes also covered high-severity bugs involving use-after-free conditions, JIT miscompilation, boundary-condition errors, and sandbox escape. No confirmed in-the-wild exploitation was reported at publication, but organizations were urged to deploy the updates quickly, restart browsers, and enforce enterprise browser-update policies to reduce exposure.