Google Chrome 149 fixes multiple high-severity memory corruption flaws

Google released a Stable Channel security update for Chrome Desktop, fixing a broad set of vulnerabilities in versions prior to 149.0.7827.53/54 on Windows and Mac and 149.0.7827.53 on Linux, while related records also show Chrome on Android was affected before 149.0.7827.53. The Canadian Centre for Cyber Security urged users and administrators to apply the update, and public CVE entries tie the release to numerous flaws across V8, Blink, WebRTC, Compositing, Dawn, DevTools, GPU, PDFium, Extensions, Media, TabStrip, Cast, LiveCaption, Google Lens, CSS, and USB. Many of the issues are memory-safety bugs such as use-after-free, out-of-bounds write/read, integer overflow, and type confusion, with several carrying CVSS vectors indicating high impact to confidentiality, integrity, and availability.

The patched vulnerabilities include remote code execution inside Chrome’s sandbox through crafted HTML pages or malicious PDF files, information disclosure from process memory, UI spoofing, navigation restriction bypass, privilege escalation on adjacent networks, and multiple paths that could aid sandbox escape after renderer compromise. Notable examples include CVE-2026-11188 in Android USB that could potentially enable sandbox escape, CVE-2026-11256 in the GPU component, CVE-2026-11173 in V8, CVE-2026-11118 and CVE-2026-11074 in WebRTC, and several PDFium bugs including CVE-2026-11303, CVE-2026-11305, and CVE-2026-11307. Visible metadata from one additional report also points to CVE-2026-10881, linked to Chrome 149, the ANGLE layer, and memory corruption involving GPU buffer overflow and use-after-free.