Loading story…
Google released Chrome 150.0.7871.124/.125 for desktop to address 15 security flaws, including two critical use-after-free vulnerabilities in Ozone tracked as CVE-2026-15764 and CVE-2026-15765. The update also fixes several high-severity issues affecting Skia, GPU, Core, libyuv, and Linux Toolkit Theming, with Google limiting technical details until more users are patched or dependent third-party fixes are available.
Among the newly detailed high-severity bugs, CVE-2026-15767 is a heap buffer overflow in libyuv on Windows that could allow arbitrary code execution inside the browser sandbox via a crafted video file, while CVE-2026-15769, CVE-2026-15772, CVE-2026-15773, and CVE-2026-15774 could enable sandbox escape through crafted HTML content after renderer compromise. These flaws affect Chrome versions prior to 150.0.7871.125, span Linux, Windows, and Android components, and were assessed as having no known exploitation at publication despite potentially high impact on confidentiality, integrity, and availability.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
The CVE record for a high-severity use-after-free vulnerability in Chrome's Skia component was updated to add affected-version details, references, CVSS v3.1 scoring, and an SSVC assessment. The issue affects versions prior to 150.0.7871.125 and could allow sandbox escape after renderer compromise via a crafted HTML page.
The CVE record for a high-severity use-after-free vulnerability in Chrome's Core component on Windows was updated with CVSS v3.1 and SSVC information. The flaw affects versions prior to 150.0.7871.125 and could allow a remote attacker to potentially achieve sandbox escape via a crafted HTML page.
The CVE record for a high-severity use-after-free vulnerability in Chrome's GPU component on Android was updated with CVSS v3.1 and SSVC data. The flaw affects versions prior to 150.0.7871.125 and could allow sandbox escape after renderer compromise using a crafted HTML page.
The CVE record for a high-severity Linux Toolkit Theming vulnerability in Chrome on Linux was updated with a CVSS v3.1 vector and SSVC assessment. The issue affects versions prior to 150.0.7871.125 and could enable sandbox escape after renderer compromise via a crafted HTML page.
The CVE record for a high-severity heap buffer overflow in Chrome's libyuv on Windows was updated with CVSS v3.1 and SSVC information. The flaw affects versions prior to 150.0.7871.125 and could allow arbitrary code execution inside the browser sandbox via a crafted video file.
Google announced a Stable channel update to Chrome 150.0.7871.124/.125 for Windows and Mac and 150.0.7871.124 for Linux. The release included 15 security fixes across multiple components, including two critical Ozone use-after-free flaws and several high-severity issues.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
12 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcecybersecuritynews.com
Open sourcesecurityweek.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcechromium.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has released a major Chrome security update fixing **382 vulnerabilities** across Windows, macOS, Linux, iOS, and Android, including **15 critical** and **67 high-severity** flaws. The patched bugs span components such as **Extensions, GPU, WebUSB, Browser, Bluetooth, Chromoting, Ozone, Dawn/WebGPU, ANGLE, Skia, Views, Fullscreen, and iOSWeb**, with many involving `use-after-free`, `type confusion`, out-of-bounds access, uninitialized use, and insufficient validation of untrusted input. Google said **358** of the issues were found internally through tooling and fuzzing, while others were reported by external researchers. Several of the vulnerabilities could be triggered through crafted web content to achieve renderer compromise, heap corruption, control-flow hijacking, and in some cases **sandbox escape** leading to code execution on the underlying system. Reported examples include **CVE-2026-13789**, a high-severity `use-after-free` flaw in the GPU component that could enable a remote attacker with renderer access to escape the sandbox, along with critical issues such as **CVE-2026-13774**, **CVE-2026-13775**, **CVE-2026-13776**, **CVE-2026-13778**, **CVE-2026-13782**, **CVE-2026-13785**, and **CVE-2026-13788**. Google said it had **no evidence of in-the-wild exploitation** at release, but urged rapid deployment of the update, particularly in enterprise environments and for Chromium-based browsers.
Jul 12, 2026
Google released a Chrome 150 Stable security update that patches **27 vulnerabilities**, including two critical use-after-free flaws that could lead to remote code execution if a user visits a malicious webpage. The most severe issues are **`CVE-2026-15112`** in Chrome’s Ozone platform abstraction layer and **`CVE-2026-15129`** in the Views UI framework. Patched versions are **`150.0.7871.114/.115`** for Windows and macOS and **`150.0.7871.114`** for Linux. The update also fixes 13 use-after-free bugs overall, along with integer overflow, out-of-bounds access, uninitialized use, and insufficient validation issues affecting components including **V8, ANGLE, Autofill, WebRTC, Codecs, Extensions, Forms, Payments,** and **Navigation**. Google said most flaws were found internally, with only three reported externally for a combined **$3,000** in bug bounty rewards, and said there is no indication of active exploitation, though the volume of memory-safety defects raises the risk of weaponization.
Jul 10, 2026
Google released Chrome 152 for Windows, macOS, and Linux with fixes for 327 vulnerabilities, including 18 rated critical and 53 rated high severity. Affected desktop versions are `152.0.7977.64/.65` for Windows and macOS and `152.0.7977.64` for Linux. The fixes address arbitrary-code-execution, security-bypass, and information-disclosure risks; Google has restricted access to some bug details while users deploy the update and reports no known active exploitation. The most significant fixes include `CVE-2026-79282`, a use-after-free flaw in ANGLE that a malicious HTML page could exploit to execute code outside Chrome's browser sandbox, and `CVE-2026-78899`, a V8 use-after-free vulnerability rated CVSS 8.8 that could enable code execution within the sandbox. Organizations should urgently update managed Chrome installations and require browser restarts, as both flaws are reachable through malicious websites and could be combined in exploit chains.
Aug 27, 2026