Loading story…
Google has released a major Chrome security update fixing 382 vulnerabilities across Windows, macOS, Linux, iOS, and Android, including 15 critical and 67 high-severity flaws. The patched bugs span components such as Extensions, GPU, WebUSB, Browser, Bluetooth, Chromoting, Ozone, Dawn/WebGPU, ANGLE, Skia, Views, Fullscreen, and iOSWeb, with many involving use-after-free, type confusion, out-of-bounds access, uninitialized use, and insufficient validation of untrusted input. Google said 358 of the issues were found internally through tooling and fuzzing, while others were reported by external researchers.
Several of the vulnerabilities could be triggered through crafted web content to achieve renderer compromise, heap corruption, control-flow hijacking, and in some cases sandbox escape leading to code execution on the underlying system. Reported examples include CVE-2026-13789, a high-severity use-after-free flaw in the GPU component that could enable a remote attacker with renderer access to escape the sandbox, along with critical issues such as CVE-2026-13774, CVE-2026-13775, CVE-2026-13776, CVE-2026-13778, CVE-2026-13782, CVE-2026-13785, and CVE-2026-13788. Google said it had no evidence of in-the-wild exploitation at release, but urged rapid deployment of the update, particularly in enterprise environments and for Chromium-based browsers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Google published a Stable Channel Chrome for Desktop security advisory covering versions prior to 150.0.7871.100/101 on Windows and Mac and prior to 150.0.7871.100 on Linux. The notice urged users and administrators to review the advisory and apply the necessary updates.
Reporting highlighted CVE-2026-13789, a high-severity use-after-free vulnerability in Chrome's GPU component. The flaw could allow an attacker who had already compromised the renderer process to escape the sandbox via a crafted HTML page.
Google released a Chrome stable-channel security update addressing 382 vulnerabilities across multiple platforms. The update included 15 critical flaws, and reporting notes Google had not disclosed any of the newly patched issues as exploited in the wild at release time.
Google issued a Chrome security update on June 9, 2026. This appears to be a distinct patch release separate from the July 1, 2026 update already captured in the timeline.
EG-FinCIRT published a notice for a Google Chrome security update on June 7, 2026. Based on the date provided in the reference metadata and title, this appears to be a separate update from the June 9 and July 1 releases already in the timeline.
EG-FinCIRT published a notice for a Google Chrome security update dated June 1, 2026. Based on the reference title and publication date, this appears to be a separate Chrome patch release preceding the June 7 and June 9 updates already in the timeline.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcelists.debian.org
Open sourcetechrepublic.com
Open sourcemalwarebytes.com
Open sourceegfincirt-wpn.azurewebsites.net
Open sourceegfincirt-wpn.azurewebsites.net
Open sourceopennet.ru
Open sourcechromereleases.googleblog.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has released a major Chrome Stable update that patches **151 security vulnerabilities**, including **22 critical flaws** affecting desktop builds on Windows, macOS, and Linux, with related fixes also noted for Android and iOS. The patched desktop versions are `148.0.7778.216/217` for Windows, `148.0.7778.215/216` for macOS, and `148.0.7778.215` for Linux. Google and national cyber authorities urged users and administrators to update immediately, while the company temporarily withheld detailed technical information until most users receive the fixes. Google said none of the newly disclosed critical issues were known to be exploited in the wild at disclosure time. The most serious bugs include **CVE-2026-9872** in the GPU process, **CVE-2026-9873** in Network, **CVE-2026-9874** in Dawn, and **CVE-2026-9875** in WebGL, alongside numerous flaws in **ANGLE**, Bluetooth, Base, Proxy, media, and other browser components. The vulnerabilities span use-after-free, out-of-bounds read and write, integer overflow, race condition, and insufficient validation weaknesses that could enable **remote code execution**, sandbox escape, data corruption, or broader system compromise through malicious web content. Google said many issues were found internally through fuzzing, sanitizers, and control-flow integrity tooling, while external researchers also reported multiple bugs through the bounty program, with rewards reaching **$43,000**.
Jun 29, 2026
Google released a Stable Channel update for Chrome Desktop that fixes **79 vulnerabilities**, including **14 critical flaws**, in version `148.0.7778.167/168` for Windows and Mac and `148.0.7778.167` for Linux. The most severe issues include heap buffer overflows, integer overflows, use-after-free bugs, a race condition, and insufficient validation of untrusted input in components such as **WebML, Skia, Blink, ANGLE, and Payments**. Google said it is restricting technical details and proof-of-concept information until more users are patched, citing the risk that browser bugs can be weaponized for arbitrary code execution, sandbox escape, data theft, and host compromise. Government and industry advisories urged organizations to update immediately, with the Canadian Centre for Cyber Security issuing notice **AV26-458** for versions prior to `148.0.7778.167/168` on Windows and Mac and prior to `148.0.7778.167` on Linux. The latest release follows an earlier Chrome advisory, **AV26-358**, that covered versions prior to `147.0.7727.101/102`, underscoring a continuing stream of browser security fixes. Google also disclosed bug bounty awards tied to the new patch set, including **$43,000** for `CVE-2026-8509` in WebML and **$25,000** for `CVE-2026-8510` in Skia.
Jun 29, 2026
Google Chrome addressed three **use-after-free** vulnerabilities tracked as `CVE-2026-7347`, `CVE-2026-7363`, and `CVE-2026-7344` in versions prior to `147.0.7727.138`. The bugs affect the **Chromoting**, **Canvas**, and **Accessibility** components, respectively, and all were classified under `CWE-416`. Two of the flaws were rated **critical**: `CVE-2026-7363` allows a remote attacker to execute arbitrary code inside the browser sandbox on Linux and ChromeOS by luring a user to a crafted HTML page, while `CVE-2026-7344` could let an attacker escape Chrome's sandbox on Windows after compromising the renderer process via crafted web content. The third issue, `CVE-2026-7347`, was rated **high severity** and affects Chromoting, where malicious network traffic could enable arbitrary code execution without privileges or user interaction. CVSS data added to the records shows network-based exploitation with high impact to confidentiality, integrity, and availability, with `CVE-2026-7363` and `CVE-2026-7344` carrying the vector `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`. The vulnerabilities were documented in Chrome and Chromium tracking references, underscoring the need for organizations to move affected browsers to `147.0.7727.138` or later.
Jun 29, 2026