Chrome 147 and Firefox 150 Updates Fix Memory-Safety Flaws
Summary
Google’s Chrome 147 update fixes 30 security flaws, while Mozilla’s Firefox 150.0.1 fixes four. The updates address memory-safety bugs, including critical flaws; Firefox ESR releases also receive fixes.
Key points
- Chrome 147 fixes 30 security flaws, including four critical use-after-free vulnerabilities and 16 high-severity use-after-free flaws.
- Chrome 147 is rolling out as versions 147.0.7727.137/138 for Windows and macOS and 147.0.7727.137 for Linux.
- Google says it awarded $30,000 in bug bounties for four fixes; the highest reported award was $16,000 for a GPU use-after-free flaw.
- Firefox 150.0.1 fixes four security defects, including memory-safety bugs with evidence of memory corruption and an information-disclosure flaw in the Audio/Video component.
- Firefox ESR 140.10.1 and 115.35.1 also received fixes; ESR 140.10.1 additionally addresses a medium-severity sandbox escape.
Article Details
- Event Type
- Google and Mozilla released security updates for Chrome and Firefox, addressing multiple vulnerabilities.
- Impact
- The updates address critical and high-severity memory-safety flaws. The Chrome use-after-free vulnerabilities could lead to arbitrary code execution, information disclosure, or crashes. Mozilla reports evidence of memory corruption in some Firefox bugs and says they could potentially be exploited to run arbitrary code; another Firefox flaw may disclose information, and Firefox ESR 140.10.1 also fixes a medium-severity sandbox escape.
CVE
CVE-2026-7320Red Hat · Red Hat Enterprise Linux 10; Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Support; +15 moreThe fourth issue, tracked as CVE-2026-7320, is described as an information disclosure bug rooted in incorrect boundary conditions in the Audio/Video component.CVE-2026-7322Red Hat · Red Hat Enterprise Linux 10; Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Support; +15 moresecurity defects, including critical and high-severity memory safety bugs collectively tracked as CVE-2026-7322, CVE-2026-7323, and CVE-2026-7324.CVE-2026-7323Red Hat · Red Hat Enterprise Linux 10; Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Support; +15 moreincluding critical and high-severity memory safety bugs collectively tracked as CVE-2026-7322, CVE-2026-7323, and CVE-2026-7324.CVE-2026-7324Vendor / Product unavailableand high-severity memory safety bugs collectively tracked as CVE-2026-7322, CVE-2026-7323, and CVE-2026-7324.CVE-2026-7343Google · ChromeTracked as CVE-2026-7363, CVE-2026-7361, CVE-2026-7344, and CVE-2026-7343, the bugs impact the Canvas, iOS, Accessibility, and Views browser components.CVE-2026-7344Google · ChromeTracked as CVE-2026-7363, CVE-2026-7361, CVE-2026-7344, and CVE-2026-7343, the bugs impact the Canvas, iOS, Accessibility, and Views browser components.CVE-2026-7361Google · ChromeTracked as CVE-2026-7363, CVE-2026-7361, CVE-2026-7344, and CVE-2026-7343, the bugs impact the Canvas, iOS, Accessibility, and Views browser components.CVE-2026-7363Google · ChromeTracked as CVE-2026-7363, CVE-2026-7361, CVE-2026-7344, and CVE-2026-7343, the bugs impact the Canvas, iOS, Accessibility, and Views browser components.
Vendors
Products
Firefox ESRFixes for these security defects were included in the newly released Firefox ESR 140.10.1 and Firefox ESR 115.35.1 as well. The former also addresses a medium-severity sandbox escape.Google ChromeGoogle and Mozilla on Tuesday announced fresh security updates for Chrome and Firefox users, addressing multiple memory safety vulnerabilities.Mozilla FirefoxGoogle and Mozilla on Tuesday announced fresh security updates for Chrome and Firefox users, addressing multiple memory safety vulnerabilities.