Chrome, Firefox Updates Patch Dozens of Vulnerabilities Chrome、Firefox更新修复数十个漏洞

TL;DR

• Mozilla released Firefox 154 with patches for 58 CVEs, including 20 high-severity flaws, roughly half being memory safety bugs exploitable for code execution
• Google released Chrome 151 addressing 15 vulnerabilities, including two critical buffer overflow bugs in WebGL and Dawn
• Firefox 154's high-severity fixes span use-after-free defects, privilege escalation vulnerabilities, sandbox escape flaws, and mitigation bypass weaknesses
• Thunderbird 154 was simultaneously released with 55 patched vulnerabilities, alongside ESR updates for both Firefox and Thunderbird
• Google discovered 11 of the Chrome vulnerabilities internally, while 4 were reported by external researchers

Why It Matters

This release cycle highlights the escalating volume of vulnerabilities in widely-used browser engines, with Mozilla patching nearly 60 CVEs in a single update—a scale that strains traditional security operations. The concentration of memory safety bugs as the primary attack vector underscores the ongoing industry-wide challenge of eliminating entire classes of vulnerabilities in C/C++-based browser architectures.

Technical Details

• Firefox 154: 58 CVEs patched, with 20 classified as high-severity; approximately 50% are memory safety bugs enabling remote code execution
• High-severity breakdown in Firefox: 6 use-after-free defects, 6 privilege escalation vulnerabilities, 2 information disclosure bugs, 1 sandbox escape flaw, 1 site isolation issue, and 1 mitigation bypass weakness
• Chrome 151: 15 vulnerabilities resolved, including 2 critical buffer overflows in WebGL and Dawn graphics APIs; remaining flaws cover race conditions, type confusion, information leaks, and uninitialized resource usage
• ESR and Thunderbird updates: Firefox ESR 115.39, 140.14, and 153.1; Thunderbird 140.14, 153.1, and 154 all received patches for dozens of overlapping security defects
• Discovery attribution: Google credited 11 internally found defects and 4 from external researchers; Mozilla also resolved multiple internally discovered memory corruption bugs collectively assigned 3 CVEs

Industry Insight

The sheer volume of vulnerabilities in a single browser update cycle signals that traditional patching models are struggling to keep pace with codebase complexity—organizations should prioritize automated patch deployment and consider ESR channels for production stability over immediate feature updates. The persistent dominance of memory safety bugs as an exploit vector reinforces the strategic value of adopting memory-safe languages and hardening techniques like ASAN, UAF sanitizers, and sandboxing at the engine level. Security teams should treat these releases as urgent action items, particularly given the critical buffer overflow flaws in graphics APIs that could enable drive-by exploitation through malicious web content.

TL;DR

• Firefox 154稳定版发布，修复58个CVE漏洞，其中20个高危，约半数内存安全漏洞可被利用执行代码
• Chrome 151修复15个漏洞，含2个关键级缓冲区溢出漏洞（WebGL和Dawn组件）
• Thunderbird 154同步发布，修复55个安全漏洞，多版本ESR同步更新
• Google内部发现11个漏洞，4个由外部研究者报告，赏金金额未公开
• 修复类型涵盖use-after-free、权限提升、沙箱逃逸、信息泄露等高危缺陷

为什么值得看

本文详细记录了主流浏览器最新安全补丁的漏洞分布和技术细节，为安全从业者和企业IT管理员提供重要的漏洞管理参考。通过对比Chrome和Firefox的修复策略，可洞察两大浏览器厂商在内存安全和漏洞响应方面的技术路线差异。

技术解析

Firefox 154稳定版修复58个CVE，其中20个高危漏洞约半数属于内存安全缺陷，存在远程代码执行风险。修复内容包括6个use-after-free缺陷、6个权限提升漏洞、2个信息泄露漏洞、1个沙箱逃逸漏洞、1个站点隔离问题和1个缓解措施绕过弱点。Mozilla还修复了3个内部发现的内存损坏漏洞。

Chrome 151修复15个漏洞，其中2个关键级缓冲区溢出漏洞位于WebGL和Dawn图形组件。其余13个高危漏洞涉及不恰当实现、链接跟随、竞态条件、use-after-free、未初始化资源使用、信息泄露和类型混淆等问题。

Google内部发现11个漏洞，4个由外部研究者报告，赏金金额尚未公布。Chrome 151.0.7922.169/.170已在Windows/macOS部署，Linux版本为151.0.7922.169。

行业启示

浏览器安全更新规模持续扩大，反映出现代浏览器代码库复杂性和攻击面日益增长，企业需建立自动化漏洞扫描和补丁管理机制。内存安全漏洞仍占主导地位，表明Rust等内存安全语言的采用和代码审查流程优化是降低风险的关键方向。厂商应加强内部安全研究和外部漏洞赏金计划，以应对日益复杂的网络威胁环境。