Source: www.securityweek.com – Author: Ionut Arghire
Fresh stable iterations of Chrome and Firefox were released on Wednesday with patches for two dozen vulnerabilities across the popular web browsers, including high-severity memory safety flaws.
Chrome 138 has arrived with 11 security fixes, including three for medium- and low-severity bugs reported by security researchers.
These include a use-after-free defect in Animation for which Google handed out a $4,000 bug bounty reward, and an insufficient policy enforcement issue in Loader and an insufficient data validation flaw in DevTools that earned the reporting researchers $1,000 rewards each.
The latest Chrome iteration is now rolling out as version 138.0.7204.49 for Linux and as versions 138.0.7204.49/50 for Windows and macOS.
Google makes no mention of any of the addressed vulnerabilities being exploited in attacks, but users are advised to update their browsers as soon as possible.
On Wednesday, Mozilla dropped Firefox 140 to the stable channel with patches for 13 security defects, and announced updates for Firefox ESR 128.12 and Firefox ESR 115.25.
Two of the CVEs addressed with the latest Firefox release are high-severity memory safety bugs, namely a use-after-free issue in FontFaceSet and memory corruption defects that, with enough effort, could be exploited for remote code execution.
The update also fixes six medium-severity vulnerabilities leading to the exposure of a persistent UUID to identify the browser, a lack of warning when opening files with the terminal extension, policy bypass, phishing attacks on Android, security checks bypass, and cross-site scripting attacks.
Advertisement. Scroll to continue reading.
Firefox ESR 128.12 was rolled out with patches for five of these vulnerabilities, while Firefox ESR 115.25 arrived with two fixes. Mozilla makes no mention of any of these bugs being exploited in the wild.
Related: Chrome 137 Update Patches High-Severity Vulnerabilities
Related: Chrome, Firefox Updates Resolve High-Severity Memory Bugs
Related: Google Researchers Find New Chrome Zero-Day
Related: Chrome 137, Firefox 139 Patch High-Severity Vulnerabilities
Original Post URL: https://www.securityweek.com/chrome-138-firefox-140-patch-multiple-vulnerabilities/
Category & Tags: Vulnerabilities,Chrome,Firefox,vulnerability – Vulnerabilities,Chrome,Firefox,vulnerability
Views: 2
