Modern browsers are still a broad code-execution target because memory-safety bugs keep turning ordinary page loads into arbitrary code execution paths. The standard response of “update the browser” is necessary, but it does not change the fact that the attack surface spans rendering, media, accessibility, and platform code at once.
Chrome 147 rolls out 30 security fixes, including four critical use-after-free CVEs: CVE-2026-7363, CVE-2026-7361, CVE-2026-7344, and CVE-2026-7343. Mozilla also shipped Firefox updates for memory-safety defects, including critical and high-severity issues in its browser code, with fixes landing in Firefox ESR 140.10.1 and 115.35.1.
The pattern matters more than any single CVE. These fixes show that core browser subsystems keep producing exploitable memory corruption, so exposure is not limited to one feature or one vendor release.