Loading story…
Google released a Chrome Stable Channel update addressing seven vulnerabilities, including three rated critical, according to a security advisory published by Gambia's national CSIRT. The advisory points users and administrators to update Chrome promptly to reduce exposure to potentially severe browser-based attacks that could be triggered through malicious web content.
A related Chrome release reference indicates ongoing browser and platform update activity across Google's ecosystem, including ChromeOS and ChromeOS Flex beta channels, but the primary security event is the Stable Channel patch for desktop Chrome. Organizations relying on Chrome should prioritize deployment of the latest stable version across managed endpoints and verify that browser update policies are functioning as intended.
See affected versions and whether adversaries are exploiting it.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released a Chrome Stable channel update to fix **33 vulnerabilities**, including **seven Critical flaws** that could allow **remote code execution** if a user visits a malicious webpage. The update moves Chrome to **`149.0.7827.155/.156`** on Windows and macOS and **`149.0.7827.155`** on Linux, with Google rolling it out gradually. The most serious issues are largely **use-after-free** memory corruption bugs affecting components including **WebShare**, **Digital Credentials**, **File Input**, **Passwords**, and **Web Authentication**. Named issues include **`CVE-2026-12437`** in WebShare, **`CVE-2026-12439`** and **`CVE-2026-12440`** in Digital Credentials, **`CVE-2026-12442`** in Passwords, and **`CVE-2026-12443`** in Web Authentication. Google also patched High-severity flaws in **WebRTC, Extensions, Safe Browsing, GPU, File System Access, Media, Downloads,** and the **Tab Strip**, with risks ranging from data leakage and heap corruption to sandbox escape and exploit chaining. The company said technical details will remain limited until more users update and urged users and enterprises to install the patch and relaunch Chrome promptly.
Jul 12, 2026
Google released a **Chrome Stable Channel** security update for desktop, shipping **145.0.7632.116/117** for Windows and macOS and **144.0.7559.116** for Linux, and urged users to apply updates as they roll out. The Canadian Centre for Cyber Security echoed the guidance in advisory **AV26-159**, recommending administrators review Google’s bulletin and deploy the patched versions to address the disclosed vulnerabilities. Reporting on the release described an “emergency” update that fixes **three High-severity CVEs**, including multiple **out-of-bounds memory access** issues with potential exploitation impact (e.g., memory corruption that can contribute to remote code execution or exploit chains). The vulnerabilities highlighted include `CVE-2026-3061` (out-of-bounds read in Chrome’s **Media** component, reported by Luke Francis) and `CVE-2026-3062` (out-of-bounds read/write in **Tint** / WebGPU shader compiler, reported by Cinzinga), with the update recommended for rapid enterprise deployment due to the risk posed by unpatched browsers.
Jun 29, 2026
Google released a Stable Channel update for Chrome Desktop that fixes **79 vulnerabilities**, including **14 critical flaws**, in version `148.0.7778.167/168` for Windows and Mac and `148.0.7778.167` for Linux. The most severe issues include heap buffer overflows, integer overflows, use-after-free bugs, a race condition, and insufficient validation of untrusted input in components such as **WebML, Skia, Blink, ANGLE, and Payments**. Google said it is restricting technical details and proof-of-concept information until more users are patched, citing the risk that browser bugs can be weaponized for arbitrary code execution, sandbox escape, data theft, and host compromise. Government and industry advisories urged organizations to update immediately, with the Canadian Centre for Cyber Security issuing notice **AV26-458** for versions prior to `148.0.7778.167/168` on Windows and Mac and prior to `148.0.7778.167` on Linux. The latest release follows an earlier Chrome advisory, **AV26-358**, that covered versions prior to `147.0.7727.101/102`, underscoring a continuing stream of browser security fixes. Google also disclosed bug bounty awards tied to the new patch set, including **$43,000** for `CVE-2026-8509` in WebML and **$25,000** for `CVE-2026-8510` in Skia.
Jun 29, 2026