Mozilla Firefox 152.0.6 patches two critical vulnerabilities: an invalid pointer issue in the JavaScript WebAssembly component (CVE-2026-15718) and a site isolation flaw in the DOM Navigation component (CVE-2026-15719). Public exploit code is available for these Firefox bugs, though no active exploitation has been detected. Google Chrome 150.0.7871.124/.125 addresses 15 vulnerabilities, including two critical use-after-free bugs in the Ozone component (CVE-2026-15764 and CVE-2026-15765), plus 12 high-severity issues affecting components such as Skia, Libyuv, V8, and others. The Chrome update is rolling out across Windows, macOS, and Linux platforms. Neither vendor has reported exploitation in the wild. Both updates represent official fixes for critical security defects.

Successful exploitation of the Firefox vulnerabilities could lead to memory corruption or bypass of site isolation protections, potentially enabling arbitrary code execution or information disclosure. The Chrome vulnerabilities include use-after-free bugs and other memory safety issues that could allow attackers to execute arbitrary code or cause denial of service. Although public exploit code exists for Firefox flaws, no active exploitation has been observed. No exploitation in the wild has been reported for Chrome vulnerabilities. The vulnerabilities affect widely used web browsers, posing significant risk if unpatched.

Users and administrators should apply the official updates released by Mozilla (Firefox 152.0.6) and Google (Chrome 150.0.7871.124/.125) promptly to remediate these critical vulnerabilities. Both vendors have issued patches that address the security defects. No additional mitigation steps are indicated by the vendors at this time.