Loading story…
Google and Mozilla released major browser security updates to address more than 70 vulnerabilities across Chrome and Firefox, many tied to memory-safety weaknesses that could lead to remote code execution, sandbox escape, or privilege escalation. Chrome 149.0.7827.155/.156 fixes 33 flaws, including seven critical issues and 26 high-severity bugs; six of the critical flaws were reported as use-after-free vulnerabilities. Mozilla issued Firefox 152 along with Firefox ESR 115.37 and 140.12, remediating 40 vulnerabilities affecting areas such as memory corruption, denial of service, spoofing, sensitive information disclosure, and security restriction bypass.
Mozilla highlighted CVE-2026-12304, a same-origin policy bypass in the Networking: Cookies component with a CVSS score of 9.1, and CVE-2026-12289, a privilege-escalation flaw in Graphics: WebRender rated 8.8. Firefox’s fixes also covered high-severity bugs involving use-after-free conditions, JIT miscompilation, boundary-condition errors, and sandbox escape. No confirmed in-the-wild exploitation was reported at publication, but organizations were urged to deploy the updates quickly, restart browsers, and enforce enterprise browser-update policies to reduce exposure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Google released Chrome 149.0.7827.155/.156 with fixes for 33 vulnerabilities, including seven critical flaws and 26 high-severity issues. The patched bugs included multiple memory safety problems such as use-after-free vulnerabilities that could enable remote code execution or sandbox escape.
On 2026-06-17, Mozilla released Firefox 152 and Firefox ESR 115.37 and 140.12 to fix multiple security vulnerabilities. The updates addressed issues including denial-of-service, spoofing, privilege escalation, memory corruption, information disclosure, security restriction bypass, and arbitrary code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
threataft.com
Open sourceegfincirt.org.eg
Open sourceegfincirt-wpn.azurewebsites.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google and Mozilla released security updates for **Chrome**, **Firefox**, and **Firefox ESR** to fix multiple high-severity and critical browser vulnerabilities. Reporting on the latest releases says Chrome addressed **27 flaws**, including critical use-after-free bugs **`CVE-2026-15112`** in Ozone and **`CVE-2026-15129`** in the Views UI framework, both of which could allow arbitrary code execution through a crafted webpage. Separate Chrome advisories and follow-on reporting also highlighted another recent batch of fixes covering **18 security holes**, underscoring a sustained stream of browser patching activity. Mozilla's updates fixed two critical vulnerabilities, **`CVE-2026-49825`** and **`CVE-2026-49826`**, affecting the JavaScript engine and browser engine in Firefox and Firefox ESR. One report said **public exploit code is available** for both flaws, increasing the urgency for defenders to deploy updates quickly. Across the referenced advisories, the common risk is browser compromise through memory-corruption and related bugs that can lead to **credential theft, session hijacking, malware delivery, and broader enterprise access** if users remain on unpatched versions.
Jul 17, 2026
Google Chrome addressed three **use-after-free** vulnerabilities tracked as `CVE-2026-7347`, `CVE-2026-7363`, and `CVE-2026-7344` in versions prior to `147.0.7727.138`. The bugs affect the **Chromoting**, **Canvas**, and **Accessibility** components, respectively, and all were classified under `CWE-416`. Two of the flaws were rated **critical**: `CVE-2026-7363` allows a remote attacker to execute arbitrary code inside the browser sandbox on Linux and ChromeOS by luring a user to a crafted HTML page, while `CVE-2026-7344` could let an attacker escape Chrome's sandbox on Windows after compromising the renderer process via crafted web content. The third issue, `CVE-2026-7347`, was rated **high severity** and affects Chromoting, where malicious network traffic could enable arbitrary code execution without privileges or user interaction. CVSS data added to the records shows network-based exploitation with high impact to confidentiality, integrity, and availability, with `CVE-2026-7363` and `CVE-2026-7344` carrying the vector `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`. The vulnerabilities were documented in Chrome and Chromium tracking references, underscoring the need for organizations to move affected browsers to `147.0.7727.138` or later.
Jun 29, 2026
Google has released a major Chrome security update fixing **382 vulnerabilities** across Windows, macOS, Linux, iOS, and Android, including **15 critical** and **67 high-severity** flaws. The patched bugs span components such as **Extensions, GPU, WebUSB, Browser, Bluetooth, Chromoting, Ozone, Dawn/WebGPU, ANGLE, Skia, Views, Fullscreen, and iOSWeb**, with many involving `use-after-free`, `type confusion`, out-of-bounds access, uninitialized use, and insufficient validation of untrusted input. Google said **358** of the issues were found internally through tooling and fuzzing, while others were reported by external researchers. Several of the vulnerabilities could be triggered through crafted web content to achieve renderer compromise, heap corruption, control-flow hijacking, and in some cases **sandbox escape** leading to code execution on the underlying system. Reported examples include **CVE-2026-13789**, a high-severity `use-after-free` flaw in the GPU component that could enable a remote attacker with renderer access to escape the sandbox, along with critical issues such as **CVE-2026-13774**, **CVE-2026-13775**, **CVE-2026-13776**, **CVE-2026-13778**, **CVE-2026-13782**, **CVE-2026-13785**, and **CVE-2026-13788**. Google said it had **no evidence of in-the-wild exploitation** at release, but urged rapid deployment of the update, particularly in enterprise environments and for Chromium-based browsers.
Jul 12, 2026