Google and Mozilla have released fresh security updates for Chrome and Firefox users, resolving a total of 115 vulnerabilities.
The new Chrome 153 release patches 42 security defects, including three critical-severity and 28 high-severity bugs.
The critical flaws include CVE-2026-91726, an out-of-bounds read in WebGL, and CVE-2026-91721 and CVE-2026-91749, use-after-free issues in Internals and Workers, respectively.
Google also resolved multiple high-severity use-after-free, race condition, type confusion, integer overflow, incorrect authorization, and uninitialized resource weaknesses.
Of the resolved vulnerabilities, 16 were reported by external researchers, but Google has yet to disclose 14 of the bug bounty amounts it paid out. Only two rewards totaling $2,500 were disclosed.
The latest Chrome iteration is now rolling out as versions 153.0.8010.47/.48 for Windows and macOS, and as version 153.0.8010.47 for Linux.
Mozilla announced the release of Firefox 156 with fixes for 73 vulnerabilities, including 29 high-severity bugs.
Most of the addressed high-severity flaws are use-after-free and privilege escalation issues, but the browser update also resolves sandbox escape, site isolation, incorrect boundary condition, and mitigation bypass weaknesses.
Unlike previous Mozilla advisories that collectively tracked memory safety issues identified internally under a single CVE, the fresh release mentions each individual bug, which explains the larger number of CVEs.
Dozens of these security issues were also addressed in the newly released Thunderbird 156 and 140.16, and in Firefox ESR 153.3, 140.16, and 115.41.
Google and Mozilla make no mention of any of these security defects being exploited in the wild, but users are advised to update their browsers as soon as possible.
Related: Enterprises Warned of Attacks Exploiting WSO2 Vulnerability
Related: Oracle Patches 800+ Vulnerabilities in September 2026 Security Update
Related: “We Think the Security Control Is Working” Is No Longer Good Enough
Related: Chrome 153 Patches Seventh Zero-Day of 2026
