Loading story…
Google released a Chrome Stable security update for desktop that fixes two high-severity vulnerabilities that could enable arbitrary code execution or denial-of-service conditions. The update advances Chrome to 144.0.7559.132/.133 on Windows and macOS and 144.0.7559.132 on Linux, with a staged rollout over days to weeks; exploitation is described as typically requiring a victim to visit a specially crafted website that triggers the bug in the renderer context.
The patched issues are CVE-2026-1862, a type confusion flaw in the V8 JavaScript/WebAssembly engine (reported by researcher Chaoyuan Peng / @ret2happy) that can enable out-of-bounds memory access and potentially code execution, and CVE-2026-1861, a heap buffer overflow in the libvpx VP8/VP9 video codec library that could be triggered by crafted media content to crash the browser/system or potentially hijack control flow. Google is restricting detailed bug information and links until most users have applied the fix to reduce the risk of rapid exploit development via patch diffing.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Google identified CVE-2026-1862 as a type confusion flaw in the V8 JavaScript engine and CVE-2026-1861 as a heap buffer overflow in libvpx, both of which could lead to crashes and potentially code execution. The company said detailed technical information would be temporarily restricted until most users had updated and did not report active exploitation in the wild.
Google released a Chrome Stable channel desktop update to patch two high-severity memory-corruption vulnerabilities, CVE-2026-1861 and CVE-2026-1862. The rollout updated Chrome to 144.0.7559.132/.133 on Windows and macOS and 144.0.7559.132 on Linux.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google disclosed two high-severity Chrome vulnerabilities that could be triggered when a user visits a crafted HTML page, affecting the browser's **WebCodecs** and **V8** components. **`CVE-2026-5292`** is an out-of-bounds read in WebCodecs, tracked as **`CWE-125`**, and impacts Chrome versions prior to **`146.0.7680.178`**. The flaw carries a **CVSS v3.1** vector of **`AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`**, indicating remote exploitation with user interaction and potentially high impact to confidentiality, integrity, and availability. Google also recorded **`CVE-2026-6363`**, a **type confusion** issue in **V8** tracked as **`CWE-843`**, affecting Chrome versions prior to **`147.0.7727.101`**. Chrome rated the V8 bug with Medium Chromium security severity, but the published **CVSS v3.1** vector likewise reflects potentially high impact if exploited through malicious web content. Both vulnerabilities were documented in Chrome release materials and Chromium issue tracker entries, underscoring the need for organizations to update Chrome promptly to the patched versions.
Jun 29, 2026
Google released Chrome desktop updates to fix multiple security vulnerabilities, including **actively exploited zero-days** affecting versions older than `125.0.6422.60/.61` on Windows and macOS and older than `125.0.6422.60` on Linux. The most serious issue, `CVE-2024-4947`, is a high-severity **type confusion** flaw in the V8 JavaScript engine that can lead to out-of-bounds memory access and potentially remote code execution; Google said an exploit for the bug exists in the wild. The updates also addressed other flaws, including `CVE-2024-4761`, an out-of-bounds write in V8 and WebAssembly, `CVE-2024-4671`, a use-after-free issue in Visuals, `CVE-2024-4948`, a use-after-free in Dawn, `CVE-2024-4949`, a use-after-free in V8, and `CVE-2024-4950`, an implementation issue in Downloads. Google and national CSIRT reporting warned that successful exploitation could enable code execution, crashes, or exposure of sensitive data, and urged users to update Chrome immediately while some technical details remain temporarily restricted until broad patch adoption.
Aug 15, 2026
Google released Chrome stable-channel updates to address multiple security vulnerabilities, including **CVE-2024-5274**, a high-severity **type confusion** flaw in the **V8 JavaScript engine** that Google said was being exploited in the wild. The company shipped patched desktop versions `125.0.6422.112/.113` for Windows and Mac and `125.0.6422.112` for Linux, while limiting technical details until more users had updated. The bug was reported by Clément Lecigne of Google’s Threat Analysis Group and Brendon Tiszka of Chrome Security. Subsequent Chrome advisories and release notes show Google continuing to issue stable-channel fixes for broader sets of browser and platform weaknesses, including advisories describing **seven vulnerabilities with three critical flaws** and ChromeOS updates carrying additional browser and third-party security patches. The later fixes covered high-, medium-, and low-severity issues such as **use-after-free**, **type confusion**, **race conditions**, **bad cast**, and implementation errors across components including **V8**, **WebRTC**, **DevTools**, **Downloads**, **Password Manager**, and **WebGPU**, underscoring the ongoing need for rapid Chrome and ChromeOS patch deployment.
Aug 24, 2026