182 Holes Patched. Five Were Critical.

Your browser is the most attacked program on your computer — and this week, both of the big ones needed a lot of stitches. Google and Mozilla have released updates that close more than 180 security flaws between them: 83 in Chrome, 99 in Firefox, and another 103 fixes in Mozilla’s Thunderbird mail client. Five of Chrome’s flaws are rated critical. The good news, and it matters: neither company reports any of these bugs being exploited in the wild. This is the cheap window — patch before someone starts using them.

The timing is worth noting. Chrome 157, the release line this update belongs to, already had one emergency this month: an earlier build closed the eighth Chrome zero-day of 2026, a flaw that was being exploited before Google patched it. This week’s batch is a different build of the same line, and it is a mop-up on a much larger scale.

Chrome: five criticals, and everything else is high

Chrome 157.0.8103.78/.79 for Windows and macOS, and 157.0.8103.78 for Linux, fixes 83 security defects. The five critical flaws are all use-after-free bugs — the classic memory error where a program keeps using memory it has already released — in ServiceWorker, CSS, Layout, Skia and Accessibility. Every one of the remaining 78 is rated high severity. Most are more memory problems: 24 use-after-free, 10 out-of-bounds read/write and 9 type-confusion flaws, plus 9 uninitialized-resource and 8 incorrect- or missing-authorization bugs.

The credits page tells its own story about where browser security is heading. Google found 52 of the 83 flaws itself. Another 18 were reported by researchers at Anthropic and OpenAI — the AI labs are now finding browser bugs at scale — and no bounty will be paid for any of those 70. Of the outside reports that remain, Google has so far paid $4,000 for one high-severity use-after-free bug in the V8 JavaScript engine, with amounts for the other 12 reports still to be set.

Read the class list once more and a pattern jumps out: 29 of Chrome’s 83 flaws are use-after-free errors. Memory-safety bugs remain the browser’s original sin — the code is written in languages that let a program touch memory it no longer owns, and attackers have built two decades of exploitation technique on top of that single mistake. It is why so many of this batch’s bugs cluster in the rendering and scripting components, and why both vendors now treat large patch trains like this one as routine hygiene rather than exceptional events.

Firefox 160: sandbox escapes and origin bypasses

Mozilla’s Firefox 160 fixes 99 vulnerabilities, 57 of them rated high severity. The list includes the categories defenders worry about most in a browser: sandbox escape flaws, which let a malicious page break out of the browser’s isolation; privilege escalation; and same-origin policy bypasses, which undermine the rule that keeps one site’s data away from another’s. Most of the same fixes also landed in Thunderbird 160, which ships 103 patches — if your mail client is Thunderbird, it needs the same attention as your browser.

Neither Google nor Mozilla makes any mention of these vulnerabilities being exploited. That does not make the update optional. Patch batches this size are a catalog for attackers: every fixed flaw is publicly documented, and the race after a release like this is between users restarting their browsers and attackers reverse-engineering the fixes. The eighth-zero-day episode earlier this month showed how quickly a Chrome flaw can move from disclosure to active attacks.

What to do now

For Chrome, open Settings and then About Chrome, let it pull version 157.0.8103.78 or later, and restart when it asks. For Firefox and Thunderbird, update to version 160 the same way. The restart is not a formality: browser patches apply on relaunch, and a browser that has been running for three weeks with an update pending is still running the vulnerable code. Chromium-based browsers such as Edge and Brave receive the same upstream fixes through their own updates — check them as well.

If you manage a fleet, force the updates through policy rather than waiting on user habits, and sweep for stragglers still on old builds a few days from now. We covered the last Chrome emergency in our report on the eighth exploited zero-day of 2026; for a sense of how this month’s patch volume compares across vendors, see the four perfect-score SAP flaws disclosed the same week. This time, unusually, the fixes arrived before the attacks. Keep it that way.