Google Patches Seven Critical Chrome RCE Flaws in Stable Update
Vulnerability Disclosure · 14 sources · Updated 4mo ago · First seen Jun 17, 2026
Google released a Chrome Stable channel update to fix 33 vulnerabilities, including seven Critical flaws that could allow remote code execution if a user visits a malicious webpage. The update moves Chrome to 149.0.7827.155/.156 on Windows and macOS and 149.0.7827.155 on Linux, with Google rolling it out gradually. The most serious issues are largely use-after-free memory corruption bugs affecting components including WebShare, Digital Credentials, File Input, Passwords, and Web Authentication.
Named issues include CVE-2026-12437 in WebShare, CVE-2026-12439 and CVE-2026-12440 in Digital Credentials, CVE-2026-12442 in Passwords, and CVE-2026-12443 in Web Authentication. Google also patched High-severity flaws in WebRTC, Extensions, Safe Browsing, GPU, File System Access, Media, Downloads, and the Tab Strip, with risks ranging from data leakage and heap corruption to sandbox escape and exploit chaining. The company said technical details will remain limited until more users update and urged users and enterprises to install the patch and relaunch Chrome promptly.
