Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise

What it is

Coordinated browser patch day (Tuesday): Chrome 155.0.8059.79/.80 (37 fixes) and Firefox 158 (77 fixes), 114 vulnerabilities in total. The page gives no CVE IDs and no exploitation status.

Affected / versions to target

The page says the ESR and Thunderbird releases patch "many of these issues", not all of them. Parity with Firefox 158 is not guaranteed.

Severity breakdown

• Chrome (37): 7 critical (an ANGLE buffer overflow, plus six use-after-free bugs in Browser, PDF, Network, Core, SVG and Media), 29 high (mostly use-after-free), and 1 medium (also a use-after-free). The dominant class is use-after-free.
• Firefox (77): 30 high-severity. Classes named are use-after-free, sandbox escape, privilege escalation, information disclosure, incorrect boundary, race condition, JIT miscompilation and integer overflow. The sandbox escape and privilege escalation entries are the ones that matter for chaining.
• Sources: Mozilla found 40 of its bugs itself. Google found 12 of Chrome's.

What to do

• Update Chrome to 155.0.8059.79 or later, and Firefox to 158. Managed fleets on ESR should move to 153.5, and any legacy 115 ESR holdouts to 115.43. Update Thunderbird as well, since it shares Gecko code.
• Prioritize Chrome in environments that render untrusted PDFs, SVGs or media, given the critical bugs in those components.

Caveats

• The page reports no in-the-wild exploitation, so urgency rests on severity counts alone.
• At least 15 Chrome bugs came from Xinyang Ge (Anthropic), assisted by Claude, and Google pays no bounty for them. Amy Burnett of OpenAI reported 9 Firefox bugs. These are attribution details, not risk indicators.
• Google disclosed only one external reward, $1,000 for a high-severity bug. It announced higher bounties for some Chrome vulnerabilities the same day.
• Firefox Enterprise, announced Monday, is a separate product (Gecko browser plus a self-hosted management console) and is not part of this patch set.