Firefox 152.0.6 is “just” a point release, not a major update, but it does fix two zero-days. Flagged as “critical,” CVE-2036-15718 and -15719 are listed as “exploit code for these are public,” but with no active attacks yet reported. The first sounds like an RCE (remote code execution) vuln, because it’s a memory pointer mismanagement bug in WebAssembly; the second sounds like a security bypass that might lead to trouble such as authentication token theft, because it’s a DOM (domain object model) bug. The DOM is what’s supposed to keep one site’s data safe from snooping by other sites you load at the same time. Help > About Firefox to check if you’re patched.