Google patches 31 Chrome 147 flaws including critical RCE and sandbox escapes

Google released Chrome 147.0.7727.101/.102 for desktop and 147.0.7727.101 for Android to fix a broad set of browser vulnerabilities, with the desktop advisory covering 31 security issues and multiple Critical and High severity bugs. The patched set includes remote code execution and memory-corruption flaws such as CVE-2026-6299 in Prerender, CVE-2026-6297 in Proxy, CVE-2026-6300 in Blink CSS, CVE-2026-6307 and CVE-2026-6363 in V8, CVE-2026-6361 in PDFium, and several use-after-free bugs in Video, Forms, FileSystem, Cast, Permissions, and XR components. Google said Android inherits the same security fixes as the corresponding desktop release unless otherwise noted, and affected versions span Chrome builds prior to 147.0.7727.101 on Linux and Android and prior to 147.0.7727.101/.102 on Windows and macOS.

Several of the flaws could be used in exploit chains to cross Chrome security boundaries, including sandbox escape paths in GPU, Viz, Dawn WebGPU, Accessibility, Graphite, and Proxy components through CVE-2026-6314, CVE-2026-6309, CVE-2026-6310, CVE-2026-6311, CVE-2026-6304, and CVE-2026-6297. Public technical details for many Chromium issues remain restricted while patches propagate, and no confirmed in-the-wild exploitation was cited for these specific April fixes, though multiple reports note Chrome’s recent zero-day activity and the likelihood of rapid weaponization of memory-safety bugs. The Canadian Centre for Cyber Security urged organizations to review Google’s advisory and apply updates promptly, while downstream Chromium-based browsers may remain exposed until they ship their own patched releases.