Chrome and Firefox: 114 Vulnerabilities Patched as Mozilla Launches Firefox Enterprise

Google and Mozilla issued security updates on October 14, 2026 that collectively address 114 vulnerabilities: 37 in Chrome 155 and 77 in Firefox 158. Within the same window, Mozilla unveiled Firefox Enterprise, a dedicated browser for organizations with security, governance, and compliance mandates. The coincidence of the two announcements — an emergency patch cycle and a corporate product launch — highlights the tension between the browser's fragile attack surface and the competition for control of the enterprise technology stack.

The Flaw Count: Memory Safety Dominant

Chrome 155, released as versions 155.0.8059.79/.80 for Windows and macOS and 155.0.8059.79 for Linux, patches 37 security defects. Seven are rated critical: a buffer overflow in the ANGLE graphics engine and six use-after-free bugs in Browser, PDF, Network, Core, SVG, and Media components. The remaining 29 high-severity bugs fall into the same memory-safety family. The prevalence of use-after-free confirms an entrenched pattern in Chromium's attack surface, where manual memory management continues to yield vulnerabilities exploitable for remote code execution.

Firefox 158 presents a different distribution but a similar root cause: 77 vulnerabilities, 30 rated high-severity. The range of classes is broader than Chrome's — use-after-free, sandbox escape, privilege escalation, information disclosure, incorrect boundary, race condition, JIT miscompilation, integer overflow — indicating a heterogeneous attack surface spanning JavaScript rendering, the privilege model, and sandbox boundaries. Forty defects were found internally by Mozilla; nine were reported by Amy Burnett of OpenAI. The source does not specify exact CVSS scores for individual vulnerabilities or full technical details of the sandbox escape mechanism.

AI's Role in Bug Hunting

A notable signal emerges from the bounty landscape: at least 15 Chrome vulnerabilities were reported by Xinyang Ge, a researcher at Anthropic, with assistance from Claude. Google will not pay bug bounties for these reports. Google discovered 12 flaws internally and awarded $1,000 for a single high-severity bug reported by an external researcher; amounts for other reports have not been disclosed as of publication.

The participation of Anthropic and OpenAI in finding vulnerabilities in production browsers marks a shift in traditional bug hunting. Large language models are being used here as static analysis and augmented fuzzing tools, not as autonomous actors. Google's decision not to recognize bounties for AI-assisted reports — at least in this cycle — raises questions about eligibility criteria that the source does not clarify. The dossier does not specify whether Mozilla has adopted similar policies for Amy Burnett's reports.

"Finally, Firefox Enterprise is built to live alongside the systems that IT operations already use. Keep your identity provider. Keep your SIEM. Keep your MDM. Just add a browser whose management infrastructure you operate, so you decide where data lives and have greater visibility into how it moves" — Mozilla, quoted by SecurityWeek

Firefox Enterprise: Browser Sovereignty as a Market Proposition

On October 13, 2026, Mozilla introduced Firefox Enterprise, explicitly positioned for organizations with "strict security, governance, and compliance requirements." The product includes an on-premise deployable management console and uses the Gecko engine, independent of Google or Apple stacks. The proposition distinguishes itself from Chrome Enterprise and Microsoft Edge through its data-control architecture: the local administrator retains visibility over information flows without vendor cloud intermediation.

The timing — announcement less than 24 hours before the security patch release — does not imply a causal link between the two events, but places them in a common context: the browser's centrality as both an attack surface and a critical asset for enterprise digital sovereignty. For CISOs and IT leaders, Firefox Enterprise represents an on-premise alternative that reduces dependence on the Chromium/WebKit supply chain, with implications for vendor lock-in management and data-localization compliance. The source does not specify pricing, licensing models, geographic availability, or product rollout timeline.

Why It Matters

The dossier does not document in-the-wild exploitation for the October 14, 2026 vulnerabilities, but the nature of the flaws — use-after-free and buffer overflow with potential RCE — makes updating a priority for any surface exposed to untrusted web content.

The source does not specify alternative mitigations to updating, nor workarounds for environments where immediate patching is impractical. Mozilla does not detail whether Firefox Enterprise includes differentiated update channels compared to the consumer version. Google has not disclosed individual CVSS scores for Chrome 155, limiting risk-based prioritization for defense-in-depth.

The brief does not document whether the Firefox 158 vulnerabilities were reported through bug bounty programs with rewards assigned, nor full details on sandbox escape techniques. Historical context from sources on prior releases — Chrome 150 with 433 CVEs per official advisory, Firefox 152 — confirms an intensive patching cadence but is not directly relevant to the October 14 topic.

The Convergence of Tactical Security and Technology Strategy

October 14, 2026 presents a duality rarely expressed simultaneously: the operational fragility of the browser surface, documented by 114 vulnerabilities with prevalent memory-safety errors, and the strategic competition for control of the enterprise stack, embodied by Firefox Enterprise. The first demands immediate action; the second, medium-term architectural reconfiguration.

The entry of AI operators into the vulnerability discovery chain — Anthropic with Claude, OpenAI with Amy Burnett — adds a variable to the threat intelligence landscape that organizations will need to monitor to calibrate the intelligence sources underpinning their patching priorities. The absence of bounties for AI-assisted reports, at least in Google's case, suggests an unresolved regulatory friction between automation and credit recognition that vulnerability disclosure programs will need to address.

For enterprises, the day's lesson is twofold: the browser attack surface remains unassailable in its vastness, and diversification of the rendering stack — not just across vendors but across different engines — can become a supply-chain resilience metric as much as patching itself.

Sources

• https://www.securityweek.com/chrome-firefox-updates-patch-114-flaws-as-mozilla-unveils-firefox-enterprise/
• https://radar.offseq.com/threat/chrome-firefox-updates-patch-114-flaws-as-mozilla-unveils-firefox-enterprise-7bae9d9e61e9622f
• https://www.itsecuritynews.info/chrome-firefox-updates-patch-114-flaws-as-mozilla-unveils-firefox-enterprise/
• https://radar.offseq.com/threat/chrome-firefox-updates-patch-over-100-vulnerabilities-2eaa63c1c6dbc366
• https://www.rescana.com/post/chrome-150-and-firefox-152-patch-critical-vulnerabilities-cve-analysis-and-enterprise-risk-advisory
• https://www.securityweek.com/chrome-firefox-updates-patch-over-100-vulnerabilities/
• https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html
• https://www.pcworld.com/article/3182088/chrome-150-fixes-nearly-400-security-flaws-including-15-critical-ones.html
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-57/
• https://app.opencve.io/cve/?product=firefox&vendor=mozilla

Information is based on the cited source and current as of publication.

Sources