Loading story…
Google released Chrome 150.0.7871.186/.187 to the Stable channel for Windows and macOS, and 150.0.7871.186 for Linux, fixing four high-severity memory-corruption vulnerabilities in the browser. The patched flaws are CVE-2026-16807, CVE-2026-16806, CVE-2026-16805, and CVE-2026-16804; three are use-after-free bugs affecting WebMCP, Blink, and input handling, while CVE-2026-16807 is an out-of-bounds write in Chrome’s Codecs component.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
On 2026-07-23, Google released Chrome 150.0.7871.186/.187 to the Stable channel for Windows and macOS and 150.0.7871.186 for Linux, patching four high-severity memory-corruption vulnerabilities: CVE-2026-16807, CVE-2026-16806, CVE-2026-16805, and CVE-2026-16804. Google said there was no confirmed in-the-wild exploitation at the time of disclosure, and technical details would remain restricted until most users had updated.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourcechromereleases.googleblog.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released a Stable Channel update for Chrome Desktop, upgrading Windows and Mac to **149.0.7827.114/.115** and Linux to **149.0.7827.114**, to address **28 security vulnerabilities** across components including Core, DigitalCredentials, Accessibility, GPU, WebMIDI, Network, DevTools, Extensions, Video, and Views. The release includes **five critical flaws**, notably multiple use-after-free bugs, a heap buffer overflow in GPU, and insufficient validation of untrusted input in Accessibility; Google said technical details will remain restricted until most users are patched or dependent third-party fixes are available. Published CVE records tied to the release highlight several high-severity issues: **`CVE-2026-12013`**, a Chrome Media use-after-free on Windows that could be triggered through a crafted HTML page; **`CVE-2026-12014`**, a Cast use-after-free that could enable a sandbox escape from the local network segment via malicious network traffic; **`CVE-2026-12016`**, a DevTools flaw that could allow sandbox escape after renderer compromise; and **`CVE-2026-12018`**, a Mojo issue that could lead to OS-level privilege escalation on Windows through a malicious file. The Canadian Centre for Cyber Security urged users and administrators running versions prior to the patched builds to review Google’s advisory and apply updates as they become available.
Jun 29, 2026
Google has released two Chrome Stable channel security updates that together patch **34 vulnerabilities**, including multiple flaws that could allow **remote code execution** if users are lured to malicious webpages. The first update fixed **26 issues**—including **three critical**, **22 high-severity**, and **one medium-severity** bugs—in components such as **WebGL**, **WebRTC**, **V8**, **Blink**, **Network**, **WebAudio**, **Dawn**, **PDFium**, **ANGLE**, and **Extensions**. Google said the most serious weaknesses involved memory corruption, including use-after-free, heap and stack buffer overflows, out-of-bounds access, integer overflows, type confusion, and insufficient validation of untrusted input. A follow-up update addressed **eight additional high-severity vulnerabilities** affecting **WebAudio**, **CSS**, **WebGL**, **Dawn**, **WebGPU**, **Fonts**, and **FedCM**, again dominated by memory-safety bugs that could lead to browser compromise. Google shipped versions `146.0.7680.153` and `146.0.7680.154` for Windows and macOS and `146.0.7680.153` for Linux in the first release, followed by `146.0.7680.164` and `146.0.7680.165` for Windows and macOS and `146.0.7680.164` for Linux in the second. The company said many flaws were found through **AddressSanitizer**, **MemorySanitizer**, and **libFuzzer**, paid a **$7,000** bounty for one WebAudio bug, and is withholding technical details until more users have updated to reduce the risk of exploit development.
Jun 29, 2026
Google disclosed three high-severity Chrome vulnerabilities affecting versions prior to `146.0.7680.165`, including a use-after-free in FedCM (`CVE-2026-4680`), an integer overflow in the Fonts component (`CVE-2026-4679`), and a heap buffer overflow in WebGL (`CVE-2026-4675`). The bugs can be triggered through crafted HTML content and require user interaction, such as visiting a malicious page, with reported impacts including arbitrary code execution inside the browser sandbox, out-of-bounds memory writes, and out-of-bounds memory reads. All three issues were assigned high-impact `CVSS v3.1` ratings with the vector `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`, indicating network-reachable attack paths, low attack complexity, and potential compromise of confidentiality, integrity, and availability. The flaws map to memory-safety weaknesses including `CWE-416`, `CWE-472`, and `CWE-122`, and Google linked the advisories to Chrome stable channel updates and Chromium issue tracker entries as part of the fix rollout.
Jun 29, 2026