Chrome Fixed 1,237 CVEs in Two Months. One Was Exploited.

Google Chrome patched a use-after-free in its Passwords component on November 11, 2026, in an update that carried 83 security fixes. The bug, CVE-2026-126909, sits in the password manager rather than the rendering engine, which makes it a useful entry point into a bigger question: how many security problems did browsers actually fix in the last two months?

The answer, measured from the vendors’ own release notes, is a lot. Chrome shipped 1,237 distinct CVEs across 60 stable-channel updates between September 15 and November 15, 2026. Mozilla shipped 511 distinct CVEs across 26 Firefox advisories in the same window. CISA added 71 entries to its Known Exploited Vulnerabilities catalog in those two months, and exactly one of them was a browser flaw.

Key Takeaways

• CVE-2026-126909 is a use-after-free in Chrome’s Passwords component, fixed in 157.0.8103.78 on November 11, 2026; Chrome rates it High, and it was reported on October 11.
• Chrome fixed 1,237 distinct CVEs in two months across 60 stable-channel notes; four milestone releases account for most of the volume.
• Firefox fixed 511 distinct CVEs across 26 advisories in the same window.
• Volume is not exploitation: CISA’s KEV catalog added one browser CVE in the window, Chrome’s CVE-2026-125350, which Google said was exploited in the wild.

What CVE-2026-126909 is

The CVE record describes a use-after-free in Passwords in Google Chrome prior to 157.0.8103.78 that allowed a remote attacker, using social engineering, to execute arbitrary code outside the sandbox via a crafted HTML page. Chrome’s own release note lists it as High severity, “Use after free in Passwords”, reported by JonathanBouman on October 11, 2026, with bug ID 572988453.

Three details matter for anyone sizing the risk. First, the component: Passwords is the credential manager, so a memory-safety bug there touches a surface that holds secrets. Second, the impact: arbitrary code outside the sandbox means a working exploit chain would not stop at the renderer. Third, the mitigations: the record requires user interaction, which is what “leveraging social engineering” means in practice.

There is no sign of exploitation. cve.now records “no known exploitation”, an EPSS score of 0.31 percent (24th percentile), no public exploit on Exploit-DB, Metasploit or GitHub, and a CISA SSVC assessment of exploitation: none, automatable: no, technical impact: total. The CVSS 9.6 figure attached to the CVE is CISA-ADP’s worst-case score, not evidence of an attack. The practical action is the same as for every other Chrome fix: be on 157.0.8103.78 or later.

Two months of fixes

These counts come from the vendors’ own security notes. For Chrome, every CVE id appearing in a stable-channel desktop, Android or iOS update note between September 15 and November 15, 2026 was collected and de-duplicated across the 60 notes; ChromeOS, ChromeOS Flex and Long Term Support notes were excluded because they patch a separate product line. For Firefox, every Firefox advisory published by Mozilla in the window was read the same way, including ESR, Android and iOS advisories, with CVE ids de-duplicated to 511.

Apple does not publish a comparable per-browser CVE count; Safari fixes arrive inside macOS and iOS releases. Microsoft Edge receives its Chromium fixes through Edge updates.

The Chrome total is not a steady drip. Four milestone releases dominate it. Chrome 156 on October 20 is the clearest case: its note says the update “includes 354 security fixes”. Chrome 154 on September 22 states 108. The October 6 and November 3 notes give no total, but their CVE lists run to 247 and 212 distinct ids respectively. The remaining volume is patch releases, including the November 11 update with 83 fixes that carried CVE-2026-126909, and an Extended Stable update the same day with 72.

Firefox follows a similar shape at smaller scale: five release advisories (Firefox 156 through 160) plus ESR, Android and iOS advisories.

How to read the CVE counts

The first thing the numbers do not show is danger to any particular user. A CVE count is a measure of how much code a vendor hardened, not how many attacks happened. Most of the 1,237 Chrome CVEs are memory-safety issues found internally or by researchers and fixed before anyone built an exploit; many are low or medium severity; several are reported by Google’s own fuzzing infrastructure. The CVE that matters most for a risk review is the one with a public exploit and a live campaign, and in this window that was a single entry, CVE-2026-125350, which Google flagged as exploited in the wild in its November 9 note and which CISA added to KEV on November 10.

The second thing the numbers hide is overlap. Chrome’s 1,237 CVEs include fixes that ship across desktop, Android and iOS in the same release; they were de-duplicated, but a single bug still reaches several products. Firefox’s 511 likewise includes the same fix arriving through a release and two ESR advisories. Neither figure is a count of distinct weaknesses in the codebase, and neither is comparable to a count of incidents.

The third thing is that Safari has no equivalent public number. Apple ships WebKit fixes inside macOS, iOS and Safari releases, publishes CVE lists per release rather than per browser, and those releases are not directly comparable with Chrome’s or Firefox’s advisories. Zeros in CISA’s KEV catalog for Safari and Edge in this window mean no new browser entries were added; they do not mean those browsers had no problems.

What to do with it

The operational lesson from two months of data is boring and consistent. Browser patching is a weekly discipline: Chrome published security fixes on 14 separate days across the nine-week window, and Mozilla published Firefox advisories in eight of those weeks. If your fleet’s update ring takes longer than a week to apply a browser update, the gap is not theoretical.

Second, treat the credential manager as a sensitive surface. CVE-2026-126909 is a reminder that the interesting attack surface in a modern browser is not only the JavaScript engine; password managers, permissions, extensions and the payment flows all hold data worth stealing. Restricting which extensions are allowed and enforcing the password manager’s own protections is worth more than debating CVSS bands.

Third, watch the exploited list, not the volume. A team can drown in 1,237 CVEs or track the handful that have public exploits, KEV entries and live campaigns. The vendors publish enough detail to separate the two, and CISA’s catalog is the narrowest reliable list.

Finally, check the ESR and long-term-support tails. Firefox’s ESR advisories in this window carried hundreds of fixes; an organisation pinned to an old ESR for stability reasons inherits the same bug count with a slower patch path. Chrome’s Extended Stable received its own updates, but again with a delay the volume makes visible.

Sources

• cve.now, CVE-2026-126909 record: https://cve.now/CVE-2026-126909
• Chrome Releases, Stable Channel Update for Desktop, November 11, 2026: https://chromereleases.googleblog.com/
• Chrome Releases, Stable Channel Update for Desktop, November 9, 2026 (in-the-wild note for CVE-2026-125350): https://chromereleases.googleblog.com/
• Chrome Releases, milestone updates of September 22, October 6, October 20 and November 3, 2026: https://chromereleases.googleblog.com/
• Mozilla Foundation Security Advisories, Firefox 156 to 160 and ESR advisories, September 15 to November 10, 2026: https://www.mozilla.org/en-US/security/advisories/
• CISA, Known Exploited Vulnerabilities catalog, version 2026.11.13: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Apple, Apple security releases: https://support.apple.com/en-us/100100