Firefox 158, released the same day, addresses 77 defects, 30 of them high-severity, spanning use-after-free bugs, sandbox escapes, privilege escalation, information disclosure, race conditions and other memory and execution issues. Mozilla says most were found in-house (40) or by Amy Burnett of OpenAI (9). Mozilla also shipped Thunderbird 158 and 153.5 plus Firefox ESR 153.5 and 115.43 with patches for many of the same flaws.

One detail in Google's advisory: at least 15 of the Chrome vulnerabilities were reported by Xinyang Ge of Anthropic with assistance from Claude, and no bug bounty reward will be paid for them. Google found 12 defects itself and paid $1,000 for one externally reported high-severity issue, with rewards for the remaining external reports still undisclosed.

Separately, Mozilla has introduced Firefox Enterprise, a version of the browser aimed at organisations with strict security, governance and compliance requirements. It ships with a management console that organisations can host on their own infrastructure to control policies, access, data transfers and AI use. Mozilla says it is designed to work alongside existing identity providers, SIEM and MDM systems, and points to its Gecko engine, built outside Google and Apple, as reducing dependence on a single architecture.