Google has released an emergency security update for its Chrome browser, patching 33 vulnerabilities, including seven rated Critical that could allow attackers to execute arbitrary code on affected systems.
The Stable channel has been updated to 149.0.7827.155/.156 for Windows and Mac, and 149.0.7827.155 for Linux, with the rollout expected to complete over the coming days and weeks.
The most severe flaws in this update are seven Critical-rated use-after-free (UAF) bugs, all reported by Google’s internal security teams between late May and mid-June 2026.
Critical Chrome Vulnerabilities
Use-after-free vulnerabilities occur when a program continues to use a memory pointer after the memory it references has been freed a condition attackers can exploit to achieve remote code execution or privilege escalation.
| CVE | Severity | Component | Type |
|---|---|---|---|
| CVE-2026-12437 | Critical | WebShare | Use after free |
| CVE-2026-12438 | Critical | WebView | Inappropriate implementation |
| CVE-2026-12439 | Critical | Digital Credentials | Use after free |
| CVE-2026-12440 | Critical | Digital Credentials | Use after free |
| CVE-2026-12441 | Critical | File Input | Use after free |
| CVE-2026-12442 | Critical | Passwords | Use after free |
| CVE-2026-12443 | Critical | Web Authentication | Use after free |
The clustering of Critical flaws across WebAuthentication, Passwords, and Digital Credentials is especially alarming, as these components directly handle sensitive identity and credential data.
A successful exploit in any of these areas could allow a threat actor to hijack authentication sessions, extract stored credentials, or compromise digital identity workflows silently in the background.
Beyond the Critical tier, the update patches 26 High-severity vulnerabilities affecting a broad range of Chrome subsystems.
Two heap buffer overflow flaws, CVE-2026-12447 and CVE-2026-12466, were discovered in WebRTC and could be triggered by malicious video conferencing content, while CVE-2026-12461 adds a third WebRTC flaw: an out-of-bounds read.
Particularly notable is CVE-2026-12454, a race condition in Chrome’s Safe Browsing protection layer that could undermine the browser’s built-in defenses against malicious sites.
The presence of multiple bugs across the Extensions subsystem, including CVE-2026-12445, CVE-2026-12456, CVE-2026-12457, and CVE-2026-12467, raises additional concerns, as compromised or malicious browser extensions have historically served as a reliable delivery vector for enterprise-targeted attacks.
CVE-2026-12469, an uninitialized-use flaw in GPU processing, and CVE-2026-12460, an insufficient-policy-enforcement bug in File System Access, round out some of the more unusual attack surfaces patched in this release.
Google’s security team detected many of these bugs using automated tooling, underscoring how proactive fuzzing pipelines are essential to catching memory-safety issues before they reach production.
According to Google’s advisory, users and administrators should update Chrome immediately by navigating to chrome://settings/help to verify and trigger the latest version.
Enterprise teams should prioritize pushing this update via management consoles, given the concentration of flaws in credential and authentication components that pose a direct and immediate threat to identity security at scale.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
