Loading story…
Google released Chrome 141 for Windows, Mac, and Linux, introducing a comprehensive set of 21 security fixes aimed at mitigating critical vulnerabilities within the browser. Among the most significant issues addressed are two high-severity heap buffer overflow vulnerabilities: CVE-2025-11205 in the WebGPU component and CVE-2025-11206 in the video processing module. The WebGPU vulnerability, discovered by Atte Kettunen and rewarded with a $25,000 bug bounty, could allow attackers to write outside the bounds of allocated memory, potentially leading to arbitrary code execution if a user visits a malicious website. The video processing vulnerability similarly exposes users to risks of memory corruption, which could result in browser crashes or, if chained with other exploits, compromise of the underlying system. Google’s security team, along with external researchers, utilized tools such as AddressSanitizer, MemorySanitizer, and libFuzzer to identify and remediate these flaws. The update underscores the importance of prompt patching, as both vulnerabilities could be exploited remotely and pose significant risks to enterprise and individual users. The Chrome 141 release also highlights Google’s ongoing commitment to proactive security auditing and collaboration with the security research community. In addition to the two high-severity CVEs, the update resolves a variety of other memory corruption, side-channel, and logic bugs across major browser components. The distribution of substantial bug bounties reflects the critical nature and complexity of the vulnerabilities addressed. Security professionals are strongly advised to ensure immediate deployment of Chrome 141 across all supported platforms to mitigate the risk of exploitation. The update process is streamlined for end users, but enterprise administrators should verify that managed environments receive the patch without delay. The vulnerabilities fixed in this release could be leveraged in targeted attacks, especially if left unpatched in high-value environments. Google’s detailed release notes provide further technical insight into the nature of the vulnerabilities and the mitigations applied. The Chrome 141 update serves as a reminder of the persistent threat posed by memory safety issues in modern browsers. Organizations should maintain robust patch management practices to stay ahead of emerging threats. The security fixes in Chrome 141 are part of Google’s broader strategy to enhance browser resilience against sophisticated exploitation techniques. Regular updates and collaboration with the security community remain essential to safeguarding users against evolving attack vectors.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
On 2025-10-02, Google released Chrome 141 to the Stable Channel for Windows, Mac, and Linux. The update addressed 21 security issues, including two high-severity heap buffer overflow flaws tracked as CVE-2025-11205 in WebGPU and CVE-2025-11206 in Chrome's Video component.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released a Stable Channel update for Chrome Desktop, upgrading Windows and Mac to **149.0.7827.114/.115** and Linux to **149.0.7827.114**, to address **28 security vulnerabilities** across components including Core, DigitalCredentials, Accessibility, GPU, WebMIDI, Network, DevTools, Extensions, Video, and Views. The release includes **five critical flaws**, notably multiple use-after-free bugs, a heap buffer overflow in GPU, and insufficient validation of untrusted input in Accessibility; Google said technical details will remain restricted until most users are patched or dependent third-party fixes are available. Published CVE records tied to the release highlight several high-severity issues: **`CVE-2026-12013`**, a Chrome Media use-after-free on Windows that could be triggered through a crafted HTML page; **`CVE-2026-12014`**, a Cast use-after-free that could enable a sandbox escape from the local network segment via malicious network traffic; **`CVE-2026-12016`**, a DevTools flaw that could allow sandbox escape after renderer compromise; and **`CVE-2026-12018`**, a Mojo issue that could lead to OS-level privilege escalation on Windows through a malicious file. The Canadian Centre for Cyber Security urged users and administrators running versions prior to the patched builds to review Google’s advisory and apply updates as they become available.
Jun 29, 2026
Google released Chrome Stable **154.0.8037.92/.93** for Windows and macOS and **154.0.8037.92** for Linux, remediating 32 security vulnerabilities. The most severe issue, **CVE-2026-102331**, is a critical buffer overflow in ANGLE that can corrupt memory and potentially enable code execution in Chrome’s browser context. The update also fixes 26 high-severity issues, including V8 type-confusion and buffer-overflow flaws potentially reachable through malicious webpages, along with use-after-free, out-of-bounds, and uninitialized-resource bugs. Affected components include GPU, WebGPU, Mojo, Bluetooth, Passwords, WebUI, CORS, Payments, WebView, and SiteIsolation. Google is restricting some technical details until adoption increases; it reported no active exploitation and advised users to update and relaunch Chrome promptly.
Oct 2, 2026
Google released an emergency update for its Chrome browser, version 142, to patch five security vulnerabilities, including three high-severity flaws that could allow remote code execution (RCE) on Windows, macOS, Linux, and Android platforms. The most critical vulnerability, CVE-2025-12725, is an out-of-bounds write in the WebGPU graphics interface, which could enable attackers to execute arbitrary code by corrupting system memory. Two additional high-severity vulnerabilities, CVE-2025-12726 in the Views component and CVE-2025-12727 in the V8 JavaScript engine, were also addressed, both posing significant risk for memory manipulation and potential code execution. Google has limited the release of technical details to prevent exploitation before users apply the update, but internal assessments rate the vulnerabilities with a CVSS 3.1 score of 8.8, indicating a direct and serious risk. The update is being distributed across all major desktop and mobile platforms, and users are strongly advised to update Chrome promptly to mitigate the risk of exploitation. Two medium-severity issues in the Omnibox were also fixed in this release.
Jun 29, 2026