Loading story…
Google and Mozilla released security updates for Chrome, Firefox, and Firefox ESR to fix multiple high-severity and critical browser vulnerabilities. Reporting on the latest releases says Chrome addressed 27 flaws, including critical use-after-free bugs CVE-2026-15112 in Ozone and CVE-2026-15129 in the Views UI framework, both of which could allow arbitrary code execution through a crafted webpage. Separate Chrome advisories and follow-on reporting also highlighted another recent batch of fixes covering 18 security holes, underscoring a sustained stream of browser patching activity.
Mozilla's updates fixed two critical vulnerabilities, CVE-2026-49825 and CVE-2026-49826, affecting the JavaScript engine and browser engine in Firefox and Firefox ESR. One report said public exploit code is available for both flaws, increasing the urgency for defenders to deploy updates quickly. Across the referenced advisories, the common risk is browser compromise through memory-corruption and related bugs that can lead to credential theft, session hijacking, malware delivery, and broader enterprise access if users remain on unpatched versions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Google and Mozilla released browser security updates addressing multiple high-severity and critical vulnerabilities in Chrome, Firefox, and Firefox ESR. The report says Chrome fixed 27 vulnerabilities including critical flaws CVE-2026-15112 and CVE-2026-15129, while Mozilla fixed critical flaws CVE-2026-49825 and CVE-2026-49826, with public exploit code available for both Mozilla issues.
A July 2026 report states that Chrome had 18 security holes addressed by an update, highlighting a vulnerability-fixing browser patch event. The source does not explicitly anchor the underlying release to a specific event date beyond the article's publication context.
Mozilla released a Firefox security update on 2026-07-06, as reflected in the referenced advisory notice. This represents a distinct patch event for Firefox.
Google issued a Chrome security update on 2026-07-05, marking another browser patch release in the sequence of referenced updates.
A separate Google Chrome security update was published on 2026-06-25, indicating an additional patch event distinct from the prior day's release.
Google released Chrome security updates on 2026-06-24, according to the referenced security update notice. The content indicates a distinct Chrome patch event occurred on that date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
thecyberthrone.in
Open sourcemeetcyber.net
Open sourceegfincirt-wpn.azurewebsites.net
Open sourceegfincirt-wpn.azurewebsites.net
Open sourceegfincirt-wpn.azurewebsites.net
Open sourceegfincirt-wpn.azurewebsites.net
Open sourcemozilla.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google and Mozilla released major browser security updates to address more than 70 vulnerabilities across Chrome and Firefox, many tied to memory-safety weaknesses that could lead to **remote code execution**, **sandbox escape**, or **privilege escalation**. Chrome `149.0.7827.155/.156` fixes 33 flaws, including seven critical issues and 26 high-severity bugs; six of the critical flaws were reported as use-after-free vulnerabilities. Mozilla issued Firefox `152` along with Firefox ESR `115.37` and `140.12`, remediating 40 vulnerabilities affecting areas such as memory corruption, denial of service, spoofing, sensitive information disclosure, and security restriction bypass. Mozilla highlighted **CVE-2026-12304**, a same-origin policy bypass in the Networking: Cookies component with a CVSS score of **9.1**, and **CVE-2026-12289**, a privilege-escalation flaw in Graphics: WebRender rated **8.8**. Firefox’s fixes also covered high-severity bugs involving use-after-free conditions, JIT miscompilation, boundary-condition errors, and sandbox escape. No confirmed in-the-wild exploitation was reported at publication, but organizations were urged to deploy the updates quickly, restart browsers, and enforce enterprise browser-update policies to reduce exposure.
Jul 9, 2026
Multiple critical vulnerabilities were identified in Mozilla Firefox and Firefox ESR, with the most severe enabling arbitrary code execution. Affected versions include Firefox prior to 146, Firefox ESR prior to 115.31, and Firefox ESR prior to 140.6. The vulnerabilities include use-after-free in WebRTC (`CVE-2025-14321`), sandbox escape in Graphics (`CVE-2025-14322`), privilege escalation in the DOM (`CVE-2025-14323`), JIT miscompilation in the JavaScript Engine (`CVE-2025-14324`, `CVE-2025-14325`), and multiple memory safety bugs. Exploitation could allow attackers to install programs, modify or delete data, or create new accounts with full user rights, depending on the privileges of the compromised user. There are currently no reports of these vulnerabilities being exploited in the wild. Security advisories from both the Canadian Centre for Cyber Security and the Multi-State Information Sharing and Analysis Center (MS-ISAC) urge users and administrators to apply the latest updates immediately to mitigate risk. The advisories highlight the importance of prompt patching, especially for large organizations and government entities, as the risk is assessed as high for these sectors. The updates address all known vulnerabilities, and users with fewer system privileges are less impacted than those with administrative rights.
Jun 29, 2026
Google released Chrome fixes for multiple high-severity vulnerabilities in the V8 JavaScript engine, including `CVE-2025-10891`, `CVE-2025-10892`, and `CVE-2025-9864`, that could be triggered when a user visits a malicious web page. The flaws include integer overflows and a use-after-free condition that can cause heap corruption in the browser renderer and potentially lead to arbitrary code execution. A related bulletin also lists `CVE-2025-10890`, a V8 side-channel information disclosure issue, alongside the two integer overflow bugs, warning that successful exploitation could expose sensitive data or enable full system compromise. Google said the affected Chrome builds were patched across Windows, macOS, and Linux in the `140.0.7339` release line, with fixes landing in versions including `140.0.7339.80/.81` and later `140.0.7339.207/.208` depending on the flaw and platform. Several of the vulnerabilities were reportedly identified by Google’s AI-based Big Sleep system, and no public proof-of-concept exploits were cited in the referenced reports. Organizations using Chrome or Chromium-based browsers were urged to deploy the vendor updates promptly because the bugs are reachable through routine web browsing and may also affect downstream browsers that have not yet incorporated the upstream patches.
Jun 29, 2026