Loading story…
Google released a Chrome Stable channel update to address 12 security vulnerabilities across core browser components, including WebAudio, ANGLE, V8, Skia, Extensions, Chromecast, certificate handling, the GPU process, and the UI. The update brings Chrome to 150.0.7871.181/.182 on Windows and Mac and 150.0.7871.181 on Linux. Reported issues include memory-safety bugs such as type confusion, out-of-bounds write, use-after-free, integer overflow, and uninitialized memory use, tracked as CVE-2026-16413 through CVE-2026-16424.
Google said there is no evidence of in-the-wild exploitation or public proof-of-concept code for the flaws, but several of the bugs could enable memory corruption, arbitrary code execution, or security bypass in commonly targeted browser components. Ten of the vulnerabilities were reported by Google researchers, while XBOW identified two WebAudio flaws, CVE-2026-16420 and CVE-2026-16421, which were triaged by Brendan Dolan-Gavitt. Google is withholding some technical details until more users are patched, and users and enterprises are being urged to update and restart Chrome promptly.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
On July 21, 2026, Google released a Chrome Stable channel security update to versions 150.0.7871.181/.182 for Windows and Mac and 150.0.7871.181 for Linux. The update fixes 12 vulnerabilities across components including WebAudio, ANGLE, V8, Skia, Extensions, Chromecast, certificate handling, GPU, and UI, with no evidence of in-the-wild exploitation or public proof-of-concept exploits reported.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourcechromereleases.googleblog.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has released two Chrome Stable channel security updates that together patch **34 vulnerabilities**, including multiple flaws that could allow **remote code execution** if users are lured to malicious webpages. The first update fixed **26 issues**—including **three critical**, **22 high-severity**, and **one medium-severity** bugs—in components such as **WebGL**, **WebRTC**, **V8**, **Blink**, **Network**, **WebAudio**, **Dawn**, **PDFium**, **ANGLE**, and **Extensions**. Google said the most serious weaknesses involved memory corruption, including use-after-free, heap and stack buffer overflows, out-of-bounds access, integer overflows, type confusion, and insufficient validation of untrusted input. A follow-up update addressed **eight additional high-severity vulnerabilities** affecting **WebAudio**, **CSS**, **WebGL**, **Dawn**, **WebGPU**, **Fonts**, and **FedCM**, again dominated by memory-safety bugs that could lead to browser compromise. Google shipped versions `146.0.7680.153` and `146.0.7680.154` for Windows and macOS and `146.0.7680.153` for Linux in the first release, followed by `146.0.7680.164` and `146.0.7680.165` for Windows and macOS and `146.0.7680.164` for Linux in the second. The company said many flaws were found through **AddressSanitizer**, **MemorySanitizer**, and **libFuzzer**, paid a **$7,000** bounty for one WebAudio bug, and is withholding technical details until more users have updated to reduce the risk of exploit development.
Jun 29, 2026
Google released a Stable Channel update for Chrome Desktop, upgrading Windows and Mac to **149.0.7827.114/.115** and Linux to **149.0.7827.114**, to address **28 security vulnerabilities** across components including Core, DigitalCredentials, Accessibility, GPU, WebMIDI, Network, DevTools, Extensions, Video, and Views. The release includes **five critical flaws**, notably multiple use-after-free bugs, a heap buffer overflow in GPU, and insufficient validation of untrusted input in Accessibility; Google said technical details will remain restricted until most users are patched or dependent third-party fixes are available. Published CVE records tied to the release highlight several high-severity issues: **`CVE-2026-12013`**, a Chrome Media use-after-free on Windows that could be triggered through a crafted HTML page; **`CVE-2026-12014`**, a Cast use-after-free that could enable a sandbox escape from the local network segment via malicious network traffic; **`CVE-2026-12016`**, a DevTools flaw that could allow sandbox escape after renderer compromise; and **`CVE-2026-12018`**, a Mojo issue that could lead to OS-level privilege escalation on Windows through a malicious file. The Canadian Centre for Cyber Security urged users and administrators running versions prior to the patched builds to review Google’s advisory and apply updates as they become available.
Jun 29, 2026
Google has released a major Chrome Stable update that patches **151 security vulnerabilities**, including **22 critical flaws** affecting desktop builds on Windows, macOS, and Linux, with related fixes also noted for Android and iOS. The patched desktop versions are `148.0.7778.216/217` for Windows, `148.0.7778.215/216` for macOS, and `148.0.7778.215` for Linux. Google and national cyber authorities urged users and administrators to update immediately, while the company temporarily withheld detailed technical information until most users receive the fixes. Google said none of the newly disclosed critical issues were known to be exploited in the wild at disclosure time. The most serious bugs include **CVE-2026-9872** in the GPU process, **CVE-2026-9873** in Network, **CVE-2026-9874** in Dawn, and **CVE-2026-9875** in WebGL, alongside numerous flaws in **ANGLE**, Bluetooth, Base, Proxy, media, and other browser components. The vulnerabilities span use-after-free, out-of-bounds read and write, integer overflow, race condition, and insufficient validation weaknesses that could enable **remote code execution**, sandbox escape, data corruption, or broader system compromise through malicious web content. Google said many issues were found internally through fuzzing, sanitizers, and control-flow integrity tooling, while external researchers also reported multiple bugs through the bounty program, with rewards reaching **$43,000**.
Jun 29, 2026