Google and Mozilla Patch 115 Browser Flaws, Including Critical Bugs

Google and Mozilla have released browser updates addressing 115 security vulnerabilities in total. Chrome 153 fixes 42 defects, including three critical issues: CVE-2026-91726, an out-of-bounds read in WebGL, and CVE-2026-91721 and CVE-2026-91749, use-after-free vulnerabilities affecting Internals and Workers. The release also addresses high-severity use-after-free, race-condition, type-confusion, integer-overflow, authorisation and uninitialised-resource flaws.

Sixteen vulnerabilities were reported by external researchers; Google disclosed two rewards totalling $2,500, while 14 other bounty amounts remain undisclosed. Chrome 153.0.8010.47/.48 is rolling out for Windows and macOS, with version 153.0.8010.47 available for Linux.

Mozilla’s Firefox 156 release fixes 73 vulnerabilities, including 29 rated high severity. Most involve use-after-free or privilege-escalation weaknesses, alongside flaws allowing sandbox escape, site-isolation bypass, incorrect boundary handling and mitigation bypasses. Mozilla listed individual memory-safety issues rather than grouping internally identified flaws under a single CVE, contributing to the higher vulnerability count.

Many of the fixes also apply to Thunderbird 156 and 140.16, and Firefox ESR 153.3, 140.16 and 115.41. Google and Mozilla did not report exploitation of these vulnerabilities in the wild, but advised users to update their browsers as soon as possible.