Google and Mozilla shipped browser updates on 13 October 2026 covering 114 vulnerabilities between them. Chrome's share is 37 defects, including seven critical memory issues. Stable builds are 155.0.8059.79 and .80 for Windows and macOS, and 155.0.8059.79 for Linux.
What happened
SecurityWeek reports the seven critical issues as a buffer overflow in ANGLE and six use-after-free bugs in Browser, PDF, Network, Core, SVG, and Media. Use-after-free also dominates the 29 high-severity fixes. The one medium issue is a use-after-free as well.
Google's advisory, as cited by SecurityWeek, says at least 15 of the vulnerabilities were reported by Xinyang Ge of Anthropic, assisted by Claude. Google will not pay a bounty on those. Google found 12 defects itself. Japanese reporting names CVE-2026-110152 as the ANGLE buffer overflow, with CVE-2026-110149 and CVE-2026-110136 among the critical use-after-free bugs.
The same day, Mozilla released Firefox 158 with patches for 77 defects, 30 of them high severity, including sandbox escape and privilege escalation. Mozilla also introduced Firefox Enterprise, a managed browser for organizations that want policy control over data and AI use.
Who is affected
- Desktop Chrome on Windows, macOS, and Linux still below 155.0.8059.79.
- Android Chrome, which Google is updating to the same build.
- Firefox and Thunderbird users who have not moved to the 158 or matching ESR releases.
What to do now
Force a Chrome update to 155.0.8059.79 or later and restart the browser. Do the same for Firefox 158. Managed fleets should not wait for the staged rollout. Treat the Anthropic-assisted finds as a signal that memory bugs in browsers are being found faster, not as a reason to delay the update.
Source: SecurityWeek, Chrome, Firefox Updates Patch 114 Flaws.
Also on the blog
- CVE-2026-107656: FortiSandbox auth bypass, CVSS 9.6
- OpenAI employee arrested over hidden conference-room recorder
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.