Google has released a high-priority security update for Chrome’s Stable channel, patching 16 vulnerabilities, including two rated Critical that could enable remote code execution on Windows, macOS, and Linux systems.
This update arrives amid an accelerating wave of Chrome memory corruption disclosures throughout 2026.
The Stable channel has been updated to 148.0.7778.178/179 for Windows and macOS and 148.0.7778.178 for Linux, with a phased rollout expected over the coming days and weeks.
This is a secondary patch within the Chrome 148 release cycle; an earlier Chrome 148 update in May 2026 addressed a much larger batch of 79 vulnerabilities, including 14 Critical flaws across multiple components.
Multiple Chrome Vulnerabilities
Two Critical-severity vulnerabilities anchor this latest advisory, both discovered and reported internally by Google on April 20, 2026:
CVE-2026-9111 — Use-After-Free in WebRTC, this flaw allowed a remote attacker to execute arbitrary code via a specially crafted HTML page on Linux systems before version 148.0.7778.179.
WebRTC has been a persistent high-value attack surface; the component was similarly exploited in CVE-2022-2294, where a heap buffer overflow enabled in-the-wild exploitation in an active attack chain.
CVE-2026-9110 — Inappropriate Implementation in UI: This flaw targets Chrome’s user interface layer and could allow attackers to bypass critical security indicators, deceiving users into granting elevated permissions or interacting with malicious content.
High-Severity Memory Corruption Chain
Nine High-severity vulnerabilities were also patched, spanning an unusually broad range of subsystems:
- CVE-2026-9112 (UAF in GPU, $11,000 bounty) and CVE-2026-9113 (Out-of-Bounds Read in GPU, $3,000 bounty) — GPU process vulnerabilities are particularly high-risk because they can facilitate sandbox escapes, as demonstrated by the related flaw CVE-2026-7333, which involved a GPU UAF that allowed attackers to escape the browser sandbox via a crafted HTML page.
- CVE-2026-9114 (UAF in QUIC) — Targets Chrome’s encrypted transport layer, which could allow manipulation or interception of active connections.
- CVE-2026-9115 / CVE-2026-9116 — Dual Insufficient Policy Enforcement bugs in the Service Worker subsystem; similar Service Worker enforcement failures have previously been leveraged to bypass origin isolation policies.
- CVE-2026-9117 (Type Confusion in GFX) — Type confusion bugs are particularly dangerous as primitives within multi-stage RCE exploit chains, frequently allowing attackers to bridge renderer access into full system compromise.
- CVE-2026-9118 (UAF in XR), CVE-2026-9119 (Heap Buffer Overflow in WebRTC), and CVE-2026-9120 (UAF in WebRTC) — Three additional memory corruption flaws concentrated in real-time communications and extended reality components.
| CVE | Type | Component |
|---|---|---|
| CVE-2026-9121 | Out-of-Bounds Read | GPU |
| CVE-2026-9122 | Out-of-Bounds Read | GPU |
| CVE-2026-9123 | Heap Buffer Overflow | Chromecast |
| CVE-2026-9124 | Insufficient Input Validation | Input |
| CVE-2026-9126 | Use-After-Free | DOM |
Mitigation
- Navigate to
chrome://settings/helpor go to Menu → Help → About Google Chrome - Chrome will auto-detect and download the update
- Click Relaunch to apply the patch
- Confirm your version reads 148.0.7778.178 or higher
According to Google Advisory, enterprise administrators should deploy the update via policy management immediately.
Given the concentration of WebRTC and GPU memory corruption flaws, components with a documented history of enabling sandbox escapes and RCE exploit chains, delaying this patch represents measurable organizational risk.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
