SecurityWeek reported on 12 November that Google and Mozilla released browser updates fixing more than 180 flaws. Chrome 157 fixes 83. Five are critical use-after-free bugs, where a program keeps using memory it has already released. They sit in ServiceWorker, CSS, Layout, Skia and Accessibility. The other 78 are high severity. Firefox 160 fixes 99 flaws, 57 of them high severity.
Google found 52 of the Chrome flaws itself, SecurityWeek said. Researchers from Anthropic and OpenAI reported 18 more, and no reward will be paid for any of those 70. Google paid $4,000 for one V8 bug and has not set amounts for the other 12 outside reports. Firefox's fixes include sandbox escape, privilege escalation and same-origin policy bypass bugs. A sandbox escape means code breaks out of the browser's walled-off area. Google and Mozilla make no mention of exploitation. That is not proof none happened. The sources give no detail on individual bugs.
Most of this Chrome batch came from Google's own staff and AI-lab researchers, not paid outside reporters. Bugs like these sit in a browser that runs untrusted web content all day. Calling this routine patching would be our judgement, not the vendors' position, and the sandbox and privilege bugs argue against it. A budget signer can ask how fast update compliance is verified across the fleet.