- Google and Mozilla released updates on Tuesday that fix 114 vulnerabilities, SecurityWeek reports. Google's Chrome advisory credits at least 15 of Chrome's 37 fixes to a researcher assisted by Claude.
- A fix protects people only after their organization deploys it, so the speed of your rollout decides how long known flaws stay open.
- Ask how fast your fleet reaches Chrome 155.0.8059.79 and Firefox 158, and who controls AI use in the browser.
A browser update looks like housekeeping. This week's Chrome advisory credits at least 15 of its 37 fixes to a researcher assisted by Claude. Each of those fixes still needs someone to deploy it.
What shipped on Tuesday
SecurityWeek reported that Google and Mozilla released updates on Tuesday that resolve 114 vulnerabilities between them. Chrome carried 37 fixes. Firefox 158 carried 77.
Seven of the Chrome fixes carry the critical rating. One is a buffer overflow in ANGLE. The other six are use-after-free errors, each in a different part of the browser, from PDF handling to media. Another 29 were rated high, and use-after-free bugs made up most of them.
The Chrome builds are 155.0.8059.79 and .80 for Windows and macOS, and 155.0.8059.79 for Linux. Mozilla also released Thunderbird 158 and 153.5. Two extended-support Firefox lines, ESR 153.5 and 115.43, received patches for many of the same bugs.
How a use-after-free works
A use-after-free is a memory mistake. A program hands back a piece of memory, then keeps using it by accident. If an attacker can fill that spot with their own data, the program may follow their instructions. Browsers are a common home for these bugs because they run untrusted web content all day. That is why a PDF viewer or an image renderer can carry the same class of flaw.
SecurityWeek's list of Firefox's 30 high-severity bugs includes use-after-free too. It also names sandbox escape, privilege escalation, race conditions and integer overflows. A sandbox escape matters because the sandbox is the wall meant to contain a compromised web page.
Who found the bugs
SecurityWeek says Google's advisory credits at least 15 Chrome flaws to Xinyang Ge of Anthropic, assisted by Claude. Google will pay no bounty for them. Google's own staff found 12. For Firefox, SecurityWeek says Mozilla staff found 40 of the 77 and Amy Burnett of OpenAI found 9.
The report does not say whether Burnett used AI tools. It also does not say how many of the other credits involved AI. This is one release cycle, so it shows what happened this week, not a trend.
In this release, one researcher working with Claude is credited with at least 15 of Chrome's 37 fixes. Finding a flaw is only half the job. The fix protects nobody until each laptop in your company runs it.
Mozilla's pitch to organizations
The day before, Mozilla introduced Firefox Enterprise. Mozilla positions it for companies with tight security, governance and compliance obligations. It comes with a management console that a company can run on its own infrastructure. Mozilla says the console manages policies, access, data transfers and AI use.
Mozilla also notes that Firefox runs on Gecko, an engine developed independently of Google and Apple. It argues this lowers dependence on a single architecture. That is Mozilla's claim, and SecurityWeek does not test it.
Questions for your team
Start with speed. How many days pass between a browser release and the last managed device running it? Chrome shipped 37 fixes and Firefox 77 in one day, so a slow rollout leaves known flaws open.
Next, ask who controls AI features inside the browser. Mozilla's new console lists AI use among the things it manages. Whatever browser you run, someone should own that policy.
Finally, check your older branches. Firefox ESR 115.43 and 153.5 both received fixes this week. Teams on extended-support builds should confirm they are on the latest.
A fix that sits in a vendor's release notes protects no one. The work that counts is getting it onto every machine.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Google.
