Google has rolled out a Stable channel update for Chrome Desktop, patching 12 security vulnerabilities, all rated High severity.
The update brings Chrome to version 150.0.7871.181/.182 for Windows and Mac, and 150.0.7871.181 for Linux, with the rollout expected to continue over the coming days and weeks.
The fixes address a broad range of memory-safety and input-validation flaws spanning core browser components including V8, ANGLE, Skia, WebAudio, Extensions, Chromecast, Certificate handling, UI, and GPU subsystems, several of which are the kind of bug classes historically favored in exploit chains.
Chrome Update Fixes 12 Vulnerabilities
| CVE ID | Severity | Vulnerability Type | Component | Reward | Reported By | Report Date |
|---|---|---|---|---|---|---|
| CVE-2026-16420 | High | Type Confusion | WebAudio | $500 | XBOW (triaged by Brendan Dolan-Gavitt) | 2026-06-26 |
| CVE-2026-16421 | High | Inappropriate implementation | WebAudio | $500 | XBOW (triaged by Brendan Dolan-Gavitt) | 2026-06-26 |
| CVE-2026-16413 | High | Out-of-bounds write | ANGLE | N/A | Google (internal) | 2026-05-28 |
| CVE-2026-16414 | High | Insufficient validation of untrusted input | Chromecast | N/A | Google (internal) | 2026-05-28 |
| CVE-2026-16415 | High | Insufficient validation of untrusted input | Extensions | N/A | Google (internal) | 2026-06-02 |
| CVE-2026-16416 | High | Integer overflow | Chromecast | N/A | Google (internal) | 2026-06-05 |
| CVE-2026-16417 | High | Uninitialized use | Skia | N/A | Google (internal) | 2026-06-08 |
| CVE-2026-16418 | High | Stack buffer overflow | V8 | N/A | Google (internal) | 2026-06-10 |
| CVE-2026-16419 | High | Out-of-bounds read and write | ANGLE | N/A | Google (internal) | 2026-06-13 |
| CVE-2026-16422 | High | Insufficient validation of untrusted input | Certificate | N/A | Google (internal) | 2026-07-10 |
| CVE-2026-16423 | High | Use after free | UI | N/A | Google (internal) | 2026-07-14 |
| CVE-2026-16424 | High | Use after free | GPU | N/A | Google (internal) | 2026-07-14 |
Several of these bugs touch high-risk attack surfaces. The V8 stack buffer overflow (CVE-2026-16418) and the ANGLE out-of-bounds vulnerabilities (CVE-2026-16413, CVE-2026-16419) are particularly notable.
Flaws in Chrome’s JavaScript engine and graphics abstraction layer have historically been prime targets for exploit chains leading to sandbox escape or remote code execution.
The use-after-free bugs in GPU (CVE-2026-16424) and UI (CVE-2026-16423) components also carry elevated risk, as memory corruption in these areas can potentially be leveraged for arbitrary code execution if chained with a renderer exploit.
Google has restricted technical details on all 12 CVEs, consistent with its standard disclosure policy, to prevent exploitation before the patch reaches the majority of the user base. This restriction is expected to lift once broader adoption of the fixed build is confirmed.
According to Google, the two WebAudio bugs were surfaced through XBOW, an autonomous AI-driven vulnerability discovery platform, highlighting the growing role of automated fuzzing and AI-assisted bug hunting in Chrome’s security pipeline.
Mitigation
Given the High severity rating across the board and the presence of exploitable primitives like UAF and stack overflows, users and organizations should prioritize immediate patching. Chrome typically auto-updates, but manual verification is advised:
- Navigate to Settings > About Chrome to confirm the browser is running version 150.0.7871.181/.182 or later.
- Restart the browser to apply pending updates.
- Enterprise administrators managing Chrome fleets via policy should push the update through their deployment pipelines without delay.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
