Chrome and Firefox Patch Critical Browser Flaws Enabling Code Execution

Google and Mozilla released security updates for Chrome, Firefox, and Firefox ESR to fix multiple high-severity and critical browser vulnerabilities. Reporting on the latest releases says Chrome addressed 27 flaws, including critical use-after-free bugs CVE-2026-15112 in Ozone and CVE-2026-15129 in the Views UI framework, both of which could allow arbitrary code execution through a crafted webpage. Separate Chrome advisories and follow-on reporting also highlighted another recent batch of fixes covering 18 security holes, underscoring a sustained stream of browser patching activity.

Mozilla's updates fixed two critical vulnerabilities, CVE-2026-49825 and CVE-2026-49826, affecting the JavaScript engine and browser engine in Firefox and Firefox ESR. One report said public exploit code is available for both flaws, increasing the urgency for defenders to deploy updates quickly. Across the referenced advisories, the common risk is browser compromise through memory-corruption and related bugs that can lead to credential theft, session hijacking, malware delivery, and broader enterprise access if users remain on unpatched versions.