Google and Mozilla have released security updates for their browsers covering a total of 114 vulnerabilities. In the same release cycle, Mozilla introduced Firefox Enterprise, designed for organizations that want tighter control over browser policy, data flows and AI use.
On the patch side, Chrome receives 37 fixes. Seven are critical memory-safety problems, including a buffer overflow in the ANGLE component and several use-after-free bugs affecting the Browser, PDF, Network, Core, SVG and Media components. The same class of error recurs among lower-severity vulnerabilities, including most of the 29 high-severity entries Google reported. The fixes ship in versions 155.0.8059.79 and 155.0.8059.80 for Windows and macOS, and 155.0.8059.79 for Linux.
The most unusual detail concerns who found the bugs. At least 15 Chrome flaws were reported by Xinyang Ge of Anthropic with help from Claude, and these reports will not receive bug bounty payments. Google identified 12 defects internally. According to the report, one externally reported high-severity issue received a $1,000 award, while the other external reward amounts were not disclosed. The release coincided with Google's announcement of higher rewards for some vulnerability classes, a sign the company is trying to tune incentives around browser security research. AI has already accelerated fix production: Google used AI to resolve 1,072 Chrome bugs across two releases, a volume far beyond earlier cycles.
Mozilla's update is larger by count. Firefox 158 patches 77 security defects, 30 of them high-severity, including use-after-free conditions, sandbox escapes, privilege escalation, information disclosure, race conditions and integer overflows. Mozilla discovered 40 of the flaws itself, while Amy Burnett of OpenAI found nine. Patches for many of the same issues also arrive in Thunderbird 158 and 153.5 and in Firefox ESR 153.5 and 115.43.
The bigger news is Firefox Enterprise. Mozilla introduced it on Monday for organizations with strict security, governance and compliance requirements. Alongside the browser, a management console can be deployed on customer infrastructure to administer policies, access, data transfers and AI use. The product runs on Mozilla's Gecko engine, developed outside Google and Apple, and Mozilla presents it as a way to reduce dependence on a single browser architecture. The management layer is designed to sit beside existing identity providers, SIEM systems and mobile device management tools. Mozilla also stresses that organizations can control where browser management data lives and how it moves.
For security teams the picture has two parts: an update cycle that closes known flaws, and a new option to govern the browser inside their own infrastructure.
No comments yet. Be the first!