Loading story…
Google released security updates for Chrome 149 to fix multiple vulnerabilities affecting Windows, macOS, and Linux, warning that successful exploitation could lead to spoofing, denial of service, memory corruption, information disclosure, security bypass, or arbitrary code execution via a crafted HTML page. The June 7 advisory identified Chrome 149.0.7827.53/54 for Windows and macOS and 149.0.7827.53 for Linux as the patched versions.
The update notably addressed CVE-2026-10881, an out-of-bounds read/write flaw in ANGLE, and CVE-2026-11250, an inappropriate implementation issue in DevTools; both were highlighted with a CVSS 9.6 severity rating. A follow-on Chrome security update notice was also issued on June 14, reinforcing the need for organizations to validate and deploy the latest browser patches promptly after testing.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
On June 25, 2026, Google released Chrome 149.0.7827.196/197 for Windows and Mac and 149.0.7827.196 for Linux. The update addressed vulnerabilities including CVE-2026-13028 in WebGL and CVE-2026-13031 in Blink, which could allow denial of service, information disclosure, security bypass, or arbitrary code execution via a crafted HTML page.
On June 24, 2026, Google released Chrome 149.0.7827.155/.156 for Windows and Mac and 149.0.7827.155 for Linux. The update fixed multiple vulnerabilities, including CVE-2026-12440 in Chrome Digital Credentials and CVE-2026-12448 in Chrome WebView, with potential impacts including security bypass, privilege escalation, information disclosure, and arbitrary code execution.
On June 14, 2026, Google released Chrome 149.0.7827.114/.115 for Windows and Mac and 149.0.7827.114 for Linux. The update fixed multiple vulnerabilities, including CVE-2026-12027 in Chrome Headless and CVE-2026-12007 in Chrome Core, with potential impacts including denial-of-service, memory corruption, privilege escalation, information disclosure, security bypass, and arbitrary code execution.
On June 7, 2026, Google released a Chrome security update for version 149.0.7827.53/54 on Windows and Mac and 149.0.7827.53 on Linux. The update addressed multiple flaws, including CVE-2026-10881 in ANGLE and CVE-2026-11250 in DevTools, which could enable spoofing, denial-of-service, memory corruption, information disclosure, security bypass, or arbitrary code execution via a crafted HTML page.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
egfincirt.org.eg
Open sourceegfincirt.org.eg
Open sourceegfincirt-wpn.azurewebsites.net
Open sourceegfincirt.org.eg
Open sourcechromereleases.googleblog.com
Open sourceegfincirt.org.eg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Chrome patched two high-severity heap buffer overflow vulnerabilities, **`CVE-2026-5272`** in the browser's GPU component and **`CVE-2026-5275`** in **ANGLE**, that could allow **remote arbitrary code execution** if a user opened a crafted HTML page. Both flaws are classified as **`CWE-122`** and carry a **CVSS v3.1** rating of `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`, reflecting low attack complexity and high potential impact to confidentiality, integrity, and availability. The issues affect Google Chrome versions prior to **`146.0.7680.178`**, with impacted platforms listed across **Windows, Linux, and macOS**, while the ANGLE flaw was specifically described as affecting Chrome on Mac. The vulnerabilities were referenced in Google's Chrome stable channel advisory and Chromium issue tracker, underscoring the need for organizations to update browsers promptly to the patched release to reduce exposure to malicious web content.
Jun 29, 2026
Google released a Stable Channel security update for Chrome Desktop, fixing a broad set of vulnerabilities in versions prior to **`149.0.7827.53/54`** on Windows and Mac and **`149.0.7827.53`** on Linux, while related records also show Chrome on Android was affected before **`149.0.7827.53`**. The Canadian Centre for Cyber Security urged users and administrators to apply the update, and public CVE entries tie the release to numerous flaws across **V8, Blink, WebRTC, Compositing, Dawn, DevTools, GPU, PDFium, Extensions, Media, TabStrip, Cast, LiveCaption, Google Lens, CSS, and USB**. Many of the issues are memory-safety bugs such as **use-after-free**, **out-of-bounds write/read**, **integer overflow**, and **type confusion**, with several carrying CVSS vectors indicating high impact to confidentiality, integrity, and availability. The patched vulnerabilities include remote code execution inside Chrome’s sandbox through crafted HTML pages or malicious PDF files, information disclosure from process memory, UI spoofing, navigation restriction bypass, privilege escalation on adjacent networks, and multiple paths that could aid sandbox escape after renderer compromise. Notable examples include **`CVE-2026-11188`** in Android USB that could potentially enable sandbox escape, **`CVE-2026-11256`** in the GPU component, **`CVE-2026-11173`** in V8, **`CVE-2026-11118`** and **`CVE-2026-11074`** in WebRTC, and several **PDFium** bugs including **`CVE-2026-11303`**, **`CVE-2026-11305`**, and **`CVE-2026-11307`**. Visible metadata from one additional report also points to **`CVE-2026-10881`**, linked to Chrome 149, the ANGLE layer, and memory corruption involving GPU buffer overflow and use-after-free.
Jun 29, 2026
Google released a Stable Channel update for Chrome Desktop, upgrading Windows and Mac to **149.0.7827.114/.115** and Linux to **149.0.7827.114**, to address **28 security vulnerabilities** across components including Core, DigitalCredentials, Accessibility, GPU, WebMIDI, Network, DevTools, Extensions, Video, and Views. The release includes **five critical flaws**, notably multiple use-after-free bugs, a heap buffer overflow in GPU, and insufficient validation of untrusted input in Accessibility; Google said technical details will remain restricted until most users are patched or dependent third-party fixes are available. Published CVE records tied to the release highlight several high-severity issues: **`CVE-2026-12013`**, a Chrome Media use-after-free on Windows that could be triggered through a crafted HTML page; **`CVE-2026-12014`**, a Cast use-after-free that could enable a sandbox escape from the local network segment via malicious network traffic; **`CVE-2026-12016`**, a DevTools flaw that could allow sandbox escape after renderer compromise; and **`CVE-2026-12018`**, a Mojo issue that could lead to OS-level privilege escalation on Windows through a malicious file. The Canadian Centre for Cyber Security urged users and administrators running versions prior to the patched builds to review Google’s advisory and apply updates as they become available.
Jun 29, 2026