Google and Mozilla both pushed significant security updates on Tuesday, closing out dozens of vulnerabilities across Chrome, Firefox, and Thunderbird, several of which could allow attackers to execute arbitrary code.

Firefox 154

Firefox 154 landed on the stable channel with fixes for 58 CVEs, 20 of them rated high severity. Roughly half of those high-severity issues are memory safety bugs that Mozilla says could potentially be leveraged for code execution.

The high-severity fixes include six use-after-free defects, six privilege escalation vulnerabilities, two information disclosure bugs, a sandbox escape flaw, a site isolation issue, and a mitigation bypass weakness. Mozilla’s advisory also notes that its internal security team found additional memory corruption bugs that were collectively assigned three CVEs.

Alongside the browser release, Mozilla shipped Thunderbird 154 with patches for 55 vulnerabilities. Extended support versions, including Firefox ESR 115.39, ESR 140.14, and ESR 153.1, along with Thunderbird 140.14 and 153.1, also received fixes for many of the same underlying issues.

Chrome 151

Google’s Chrome 151 update resolves 15 vulnerabilities, including two critical-severity buffer overflow bugs affecting WebGL and Dawn, Chrome’s graphics and GPU components.

The remaining 13 issues are rated high severity and span a broad range of bug classes: inappropriate implementation, link following, race conditions, incorrect reference resolution, use-after-free, use of uninitialized resources, buffer overflow, incorrect calculation, information leak, and type confusion.

Google’s own security team identified 11 of the flaws, while external researchers reported the other four. The company has not yet disclosed bug bounty payouts tied to this release.

The update is rolling out as Chrome versions 151.0.7922.169/.170 for Windows and macOS, and 151.0.7922.169 for Linux.

Why It Matters

Neither vendor has indicated that any of the patched vulnerabilities are being actively exploited in the wild. Given the volume of memory safety and use-after-free issues addressed across both browsers, security teams should prioritize rolling out these updates promptly across managed fleets, particularly given the code execution potential Mozilla flagged for its high-severity fixes.