Loading story…
Google released a Chrome 150 Stable security update that patches 27 vulnerabilities, including two critical use-after-free flaws that could lead to remote code execution if a user visits a malicious webpage. The most severe issues are CVE-2026-15112 in Chrome’s Ozone platform abstraction layer and CVE-2026-15129 in the Views UI framework. Patched versions are 150.0.7871.114/.115 for Windows and macOS and 150.0.7871.114 for Linux.
The update also fixes 13 use-after-free bugs overall, along with integer overflow, out-of-bounds access, uninitialized use, and insufficient validation issues affecting components including V8, ANGLE, Autofill, WebRTC, Codecs, Extensions, Forms, Payments, and Navigation. Google said most flaws were found internally, with only three reported externally for a combined $3,000 in bug bounty rewards, and said there is no indication of active exploitation, though the volume of memory-safety defects raises the risk of weaponization.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Google rolled out Chrome 150 for Android, adding a dedicated back button in the overflow menu and shipping the same 27 security fixes as the corresponding desktop Chrome 150 releases unless otherwise noted. The update includes fixes for two critical use-after-free flaws, CVE-2026-15112 in Ozone and CVE-2026-15129 in Views.
Google released a Chrome 150 Stable security update that patches 27 vulnerabilities, including two critical use-after-free flaws in the Ozone and Views components. The update brings Chrome to version 150.0.7871.114/.115 on Windows and macOS and 150.0.7871.114 on Linux.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcemalwarebytes.com
Open sourcecyber.gc.ca
Open sourcecybersecuritynews.com
Open sourcesecurityweek.com
Open sourcechromereleases.googleblog.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has released a major Chrome Stable update that patches **151 security vulnerabilities**, including **22 critical flaws** affecting desktop builds on Windows, macOS, and Linux, with related fixes also noted for Android and iOS. The patched desktop versions are `148.0.7778.216/217` for Windows, `148.0.7778.215/216` for macOS, and `148.0.7778.215` for Linux. Google and national cyber authorities urged users and administrators to update immediately, while the company temporarily withheld detailed technical information until most users receive the fixes. Google said none of the newly disclosed critical issues were known to be exploited in the wild at disclosure time. The most serious bugs include **CVE-2026-9872** in the GPU process, **CVE-2026-9873** in Network, **CVE-2026-9874** in Dawn, and **CVE-2026-9875** in WebGL, alongside numerous flaws in **ANGLE**, Bluetooth, Base, Proxy, media, and other browser components. The vulnerabilities span use-after-free, out-of-bounds read and write, integer overflow, race condition, and insufficient validation weaknesses that could enable **remote code execution**, sandbox escape, data corruption, or broader system compromise through malicious web content. Google said many issues were found internally through fuzzing, sanitizers, and control-flow integrity tooling, while external researchers also reported multiple bugs through the bounty program, with rewards reaching **$43,000**.
Jun 29, 2026
Google released Chrome 151 Stable for desktop to address a large set of security issues, including **seven critical vulnerabilities** and hundreds of additional flaws across core browser components. The update brings Chrome to `151.0.7922.71/.72` on Windows and macOS and `151.0.7922.71` on Linux, and fixes weaknesses in areas including Compositing, Dawn, Views, Skia, Updater, ANGLE, Ozone, V8, WebGL, Media, and Chrome for iOS. Reported impacts include arbitrary code execution, sandbox escape, privilege escalation, information disclosure, data corruption, and bypass of security restrictions. The critical issues, tracked as `CVE-2026-17650` through `CVE-2026-17656`, include use-after-free bugs, a race condition, and insufficient validation of untrusted input. Google said the release contains **370 security fixes** overall, while public advisories highlighted 78 newly identified vulnerabilities, including 71 rated high severity, and noted that detailed bug information will remain temporarily restricted until most users are patched or dependent third-party fixes are available. Enterprises and users are being urged to update supported Chrome installations promptly as the rollout proceeds over days and weeks.
Jul 31, 2026
Google has released **Chrome 148** to the stable channel for Windows, macOS, Linux, and Android, patching **127 security vulnerabilities** in one of the browser’s largest security update batches. The release fixes three **Critical** flaws: `CVE-2026-7896`, an integer overflow in **Blink** that could lead to heap corruption via a crafted HTML page, plus `CVE-2026-7897` and `CVE-2026-7898`, two use-after-free bugs affecting **Mobile** and **Chromoting**. Google said no active exploitation had been reported at release, but urged users to update to **148.0.7778.96/97** immediately; Canada’s cyber agency also advised administrators to apply the update for affected desktop versions prior to those builds. The advisory also covers more than two dozen high-severity issues across major Chromium components including **V8, ANGLE, WebRTC, GPU, Skia, UI, DevTools, Printing, Audio, ChromeDriver, and AdFilter**, many involving memory-safety errors such as use-after-free, type confusion, out-of-bounds access, and insufficient validation of untrusted input. Public CVE records tied to the release include `CVE-2026-7987`, `CVE-2026-7988`, `CVE-2026-7991`, `CVE-2026-7992`, `CVE-2026-7995`, `CVE-2026-8000`, `CVE-2026-8001`, `CVE-2026-8002`, `CVE-2026-8016`, and `CVE-2026-8018`, several of which could enable code execution inside Chrome’s sandbox or, in some cases, potential sandbox escape. Google credited internal testing tools such as fuzzers and sanitizers along with external researchers, paid at least **$138,000** in bug bounties, and withheld details for some issues until most users receive fixes; because the bugs affect Chromium, downstream browsers and enterprise Chromium deployments may also need corresponding updates.
Jun 29, 2026