Zaifliklar
Chrome va Firefox yangilanishlari 200 dan ortiq zaiflikni tuzatdi
Chrome 156 yangilanishi 52 ta xatoni tuzatadi, Firefox 159 esa 167 ta xavfsizlik tuzatishi bilan chiqarildi.
Muallif
Ionut Arghire
| 28-oktabr, 2026 (9:39 ET)
*
Google va Mozilla seshanba kuni mashhur brauzerlarda 200 dan ortiq zaiflikni bartaraf etadigan yangi Chrome va Firefox yangilanishlarini e'lon qildi.
Chrome 156 yangilanishi 52 ta xavfsizlik nuqsoni uchun tuzatishlar bilan keladi, jumladan to'rtta tanqidiy darajadagi kamchilik: FileSystem'dagi xotira buzilishi, FileAPI va Skia'dagi noto'g'ri kirish tekshiruvi, hamda Layout'dagi foydalanishdan keyin bo'shatish (use-after-free).
CVE-2026-118306, FileSystem xatosi, maxsus tayyorlangan HTML sahifa orqali sandboxdan tashqarida ixtiyoriy kod bajarilishiga imkon berishi mumkin.
Shuningdek, 46 ta yuqori darajadagi xato uchun ham tuzatishlar chiqarildi, ularning aksariyati xotira buzilishi, noto'g'ri kirish tekshiruvi va foydalanishdan keyin bo'shatish muammolari.
Google xabar beruvchi tadqiqotchilarga to'lanadigan xato mukofotlarining hech birini aniqlamagan. Qolgan 39 ta zaiflik uchun hech qanday mukofot berilmaydi, ularning aksariyati ichki yoki sun'iy intellekt yordamida topilgan.
Yangi Chrome versiyasi hozirda Windows va macOS uchun 156.0.8078.73/.74, Linux uchun esa 156.0.8078.73 versiyalari sifatida foydalanuvchilarga tarqatilmoqda.
Reklama. O'qishni davom ettirish uchun pastga aylantiring.
Mozilla Firefox 159 ni 167 ta xavfsizlik nuqsoni, jumladan 108 ta yuqori darajadagi kamchilik uchun tuzatishlar bilan e'lon qildi.
Tuzatishlarning aksariyati brauzerdagi foydalanishdan keyin bo'shatish muammolarini hal qiladi. Shuningdek, bir nechta sandboxdan qochish, huquqni oshirish, noto'g'ri chegaraviy va bir xil manba siyosatini chetlab o'tish muammolari ham tuzatildi.
Seshanba kuni Mozilla shuningdek Thunderbird 159 va 153.6, hamda Firefox ESR 153.6 va 115.44 ni ham ushbu zaifliklarning ko'pchiligi uchun tuzatishlar bilan chiqardi.
Google va Mozilla ushbu xavfsizlik xatolarining hech biri yovuz maqsadlarda ishlatilganini eslatib o'tmadi, ammo foydalanuvchilarga brauzerlarini iloji boricha tezroq yangilash tavsiya etiladi.
Bog'liq: GoAhead Web Server'da topilgan TLS kamchiliklari yuzlab million qurilmalarda ishlatiladi
Bog'liq: Xitoy bilan bog'liq xakerlar PHP2Shell'dan foydalanib, firewall'larni ildizdan egallaydi
Bog'liq: HPE tarmoq mahsulotlaridagi o'nlab tanqidiy kamchiliklarni tuzatdi
Bog'liq: Hujumchilar to'rt oy ichida Arista VCO'ning uchinchi nol kun zaifligidan foydalanmoqda
Yozgan: Ionut Arghire
Ionut Arghire SecurityWeek uchun xalqaro muxbir.
Kundalik axborot byulleteni
So'nggi kiberxavfsizlik tahdidlari, tendensiyalar va mutaxassis fikrlari haqida xabardor bo'lish uchun SecurityWeek elektron pochta axborotiga obuna bo'ling.
Biznes elektron pochta*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik siyosatimizni o'qing.
Ionut Arghire'dan ko'proq
- Vendor kalitining sizib chiqishi Denver Health Plan a'zolarining 238 000 ta ma'lumotini xavf ostiga qo'ydi
- HPE tarmoq mahsulotlaridagi o'nlab tanqidiy kamchiliklarni tuzatdi
- Tushunarsiz DreamHost hodisasi elektron pochta va FTP parollarini qayta o'rnatishga majbur qildi
- O'lik Popcorn Time yangilovchisi millionlab kompyuterlarni egallash xavfiga duchor qildi
- Genesys xakerligi ichki tizimlardan mijoz ma'lumotlarini fosh qildi
- 953 ta onlayn do'kon uzoq davom etgan zararli dastur kampaniyasida zararlangan
- Golland politsiyasi bank hisoblaridan 400 000 dollardan ortiq mablag'ni o'g'irlagan NFC relay hujumlari bo'yicha ikki kishini hibsga oldi
- Mythos 5 iyul hujumida haqiqiy dunyo zararini e'tiborsiz qoldirdi
So'nggi yangiliklar
- GoAhead Web Server'da topilgan TLS kamchiliklari yuzlab million qurilmalarda ishlatiladi
- Xitoy bilan bog'liq xakerlar PHP2Shell'dan foydalanib, firewall'larni ildizdan egallaydi
- EPICS tadqiqot muassasasi nazorat dasturida uzoq yashiringan kamchiliklar tuzatildi
- Hech kim xavfsizlik so'rovnomasiga ishonmaydi. Biz baribir unga tayanamiz.
- Infisical maxfiylikni boshqarish firmasi 40 million dollar yig'ib, 600 million dollarga baholandi
- Xakerlar yangi Oracle EBS zaifligini tekshirishni boshladi
- CISA Node2Shell'dan foydalanishni ogohlantirmoqda, honeypot'lar hujum urinishlarini qayd etmoqda
- Tailscale 'Tailworm' kamchiliklarining muvofiqlashtirilmagan oshkor etilishidan so'ng tezda tuzatishlar chiqardi
Trendda
Node2Shell: Brotli kamchiligi Microsoft, Node.js, Python paketlari bo'ylab tuzatishlarni keltirib chiqardi
Tailscale 'Tailworm' kamchiliklarining muvofiqlashtirilmagan oshkor etilishidan so'ng tezda tuzatishlar chiqardi
PHP2Shell'dan foydalanish tekshiruvlardan ishlaydigan shell'larga o'tdi
Genesys xakerligi ichki tizimlardan mijoz ma'lumotlarini fosh qildi
iOS, macOS 27.2 286 ta xatoni tuzatdi; foydalanilayotgan kamchilik iOS 18 ga orqaga ko'chirildi
Kiberxavfsizlik muammosi yirik Nyu-Meksiko kasalxonasini bemorlarni boshqa joyga yo'naltirishga va klinikalarni yopishga majbur qildi
Golland politsiyasi bank hisoblaridan 400 000 dollardan ortiq mablag'ni o'g'irlagan NFC relay hujumlari bo'yicha ikki kishini hibsga oldi
HPE tarmoq mahsulotlaridagi o'nlab tanqidiy kamchiliklarni tuzatdi
Kundalik axborot byulleteni
So'nggi tahdidlar, tendensiyalar va texnologiyalar, shuningdek, soha mutaxassislari tomonidan chuqur fikrlar haqida xabardor bo'lish uchun SecurityWeek elektron pochta axborotiga obuna bo'ling.
Biznes elektron pochta*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik siyosatimizni o'qing.
Vebinar: Google Workspace'dagi AI kirish xavfi allaqachon mavjud
19-oktabr, 2026
Google Workspace'ga ulangan AI vositalari millionlab nozik elektron pochta va fayllarga kirishi mumkin. Tashkilotingiz xavfini aniqlash va AI kirishini boshqarish uchun ramka o'rganish uchun ushbu sessiyaga qo'shiling.
Ro'yxatdan o'ting
Virtual tadbir: CISO Forum 2026 sammiti
10 va 11-noyabr, 2026
CISO'lar, yuqori darajadagi kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik yetakchilarini amaliy tajriba almashish va korporativ kiberxavfsizlik strategiyasini shakllantiradigan masalalarni ko'rib chiqish uchun birlashtiramiz.
Ro'yxatdan o'ting
Harakatdagi odamlar
Noma Security Bobby Shokerni moliya direktori va Alberto Rodriguesni tijorat direktori etib tayinladi.
Neo Scott Stoutni CRO etib tayinladi.
CISA Kan Wangni moliya direktori va Khoi Nguyenni CAE etib qasamyod qildi.
Harakatdagi odamlar haqida ko'proq
Mutaxassis fikrlari
*
Hech kim xavfsizlik so'rovnomasiga ishonmaydi. Biz baribir unga tayanamiz.
B2B bitimlarining deyarli har birini nazorat qiladigan jarayon — yuboruvchining ishonchsizligi va qabul qiluvchining qabul qilishi. Kompaniyalar o'rtasida ishonch uchun nihoyat yaxshiroq asos paydo bo'lmoqda. (Sravish Sridhar)
Bu yaxshi: NetScaler nol kun zaifliklari yangi normal haqida nima deydi
Agar tez orada Citrix NetScaler tuzatishlarining yana bir to'plami chiqarilsa, tuzatish boshqaruv quvurlarini tayyor saqlang. (Tod Beardsley)
AI dasturiy ta'minot xavfsizligining kaliti tezlik emas, yetuklik
Sizning dasturchilaringiz AI qabul qilish shkalasida qayerda joylashgani xavfsizlik xavfini qanday hal qilishingizga haqiqiy ta'sir ko'rsatadi. (Matias Madou)
Kontekst zamonaviy kiberhujumlarga qarshi kurashda shohdir
Kontekstual himoya xavfsizlik jamoalariga signallarni bog'lash, keyingi qadamni oldindan bilish va tahdidlarni kuchayishdan oldin to'xtatishga yordam beradi. (Etay Maor)
AI hujum tezligini o'zgartirdi, xavfsizlik asoslarini emas
AI zaiflikni aniqlash va foydalanishni tezlashtirgan sari, virtual tuzatish hali ham chuqur himoya va kuchli ilova xavfsizligi asoslariga bog'liq. (Joshua Goldfarb)
Vulnerabilities
Chrome and Firefox Updates Patch Over 200 Vulnerabilities
The Chrome 156 update fixes 52 bugs, while Firefox 159 was rolled out with 167 security patches.
By
Ionut Arghire
| October 28, 2026 (9:39 AM ET)
*
Google and Mozilla on Tuesday rolled out fresh Chrome and Firefox updates that resolve more than 200 vulnerabilities in the popular browsers.
The Chrome 156 update arrives with patches for 52 security defects, including four critical-severity flaws: memory corruption in FileSystem, improper input validation in FileAPI and Skia, and use-after-free in Layout.
CVE-2026-118306, the FileSystem bug, could allow arbitrary code execution outside the sandbox through a crafted HTML page.
Patches were also released for 46 high-severity bugs, most of which are memory corruption, improper input validation, and use-after-free issues.
Google has not determined any of the bug bounty rewards to be paid out to the reporting researchers. No reward will be handed out for the remaining 39 vulnerabilities, most of which were found internally or with the aid of AI.
The new Chrome release is now rolling out to users as versions 156.0.8078.73/.74 for Windows and macOS, and as version 156.0.8078.73 for Linux.
Advertisement. Scroll to continue reading.
Mozilla announced the release of Firefox 159 with patches for 167 security defects, including 108 high-severity flaws.
Most of the fixes resolve use-after-free issues in the browser. Multiple sandbox escape, privilege escalation, incorrect boundary, and same-origin policy bypass issues were also patched.
On Tuesday, Mozilla also released Thunderbird 159 and 153.6, and Firefox ESR 153.6 and 115.44 with patches for many of these vulnerabilities.
Google and Mozilla make no mention of any of these security bugs being exploited in the wild, but users are advised to update their browsers as soon as possible.
Related:TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices
Related:China-Linked Hackers Exploit PHP2Shell to Root Firewalls
Related:HPE Patches Dozens of Critical Flaws in Networking Products
Related:Attackers Exploit Third Arista VCO Zero-Day in Four Months
Written ByIonut Arghire
Ionut Arghire is an international correspondent for SecurityWeek.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
More from Ionut Arghire
- Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk
- HPE Patches Dozens of Critical Flaws in Networking Products
- Unexplained DreamHost Incident Prompts Email, FTP Password Resets
- Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
- Genesys Hack Exposes Customer Data From Internal Systems
- 953 Online Stores Infected in Long-Lasting Malware Campaign
- Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts
- Mythos 5 Ignored Real-World Harm in July Attack
Latest News
- TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices
- China-Linked Hackers Exploit PHP2Shell to Root Firewalls
- Long-Hidden Flaws Patched in EPICS Research Facility Control Software
- Nobody Trusts the Security Questionnaire. We Rely on It Anyway.
- Secrets Management Firm Infisical Valued at $600 Million After $40 Million Raise
- Hackers Start Probing Fresh Oracle EBS Vulnerability
- CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
- Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
Trending
Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
PHP2Shell Exploitation Moves From Probes to Working Shells
Genesys Hack Exposes Customer Data From Internal Systems
iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics
Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts
HPE Patches Dozens of Critical Flaws in Networking Products
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Noma Security has named Bobby Shoker as CFO and Alberto Rodrigues as CCO.
Neo has appointed Scott Stout as CRO.
CISA has sworn in Kan Wang as CFO and Khoi Nguyen as CAE.
More People On The Move
Expert Insights
*
Nobody Trusts the Security Questionnaire. We Rely on It Anyway.
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)
This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)
Context Is King in the Fight Against Modern Cyberattacks
Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)
AI Has Changed Attack Speed, Not Security Fundamentals
As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)
