Chrome Desktop Update Fixes 28 Flaws Including Critical Memory Corruption Bugs

Google released a Stable Channel update for Chrome Desktop, upgrading Windows and Mac to 149.0.7827.114/.115 and Linux to 149.0.7827.114, to address 28 security vulnerabilities across components including Core, DigitalCredentials, Accessibility, GPU, WebMIDI, Network, DevTools, Extensions, Video, and Views. The release includes five critical flaws, notably multiple use-after-free bugs, a heap buffer overflow in GPU, and insufficient validation of untrusted input in Accessibility; Google said technical details will remain restricted until most users are patched or dependent third-party fixes are available.

Published CVE records tied to the release highlight several high-severity issues: CVE-2026-12013, a Chrome Media use-after-free on Windows that could be triggered through a crafted HTML page; CVE-2026-12014, a Cast use-after-free that could enable a sandbox escape from the local network segment via malicious network traffic; CVE-2026-12016, a DevTools flaw that could allow sandbox escape after renderer compromise; and CVE-2026-12018, a Mojo issue that could lead to OS-level privilege escalation on Windows through a malicious file. The Canadian Centre for Cyber Security urged users and administrators running versions prior to the patched builds to review Google’s advisory and apply updates as they become available.