Chrome Flaws Enable Arbitrary Code Execution
Google has released a new Stable Channel update for Chrome (version 144.0.7559.132/.133) on February 3, 2026, addressing two high‑severity vulnerabilities that could allow attackers to execute arbitrary code or cause system crashes.
The update is rolling out gradually for Windows, macOS, and Linux users.
According to Google’s security advisory, both vulnerabilities were discovered recently and could be exploited through specially crafted web content.
The flaws reside in Chrome’s libvpx and V8 components two critical areas often targeted in browser‑based attacks.
| CVE ID | Severity | Component | Type | Reported By | Date Reported |
|---|---|---|---|---|---|
| CVE‑2026‑1861 | High | libvpx | Heap buffer overflow | Jan 26, 2026 | |
| CVE‑2026‑1862 | High | V8 (JavaScript engine) | Type confusion | Chaoyuan Peng (@ret2happy) | Jan 29, 2026 |
The heap buffer overflow in libvpx (used for video processing) could cause memory corruption, leading to system instability or arbitrary code execution.
Meanwhile, the type confusion flaw in Chrome’s V8 JavaScript engine could allow a malicious webpage to bypass memory safety checks and execute unauthorized operations.
Although Google has not observed active exploitation of these bugs, the company has restricted full technical details until most users receive the patch.
Chrome’s ongoing use of fuzzing and sanitization tools like AddressSanitizer and libFuzzer helped detect and mitigate these vulnerabilities.
Users are strongly urged to update Chrome immediately via Settings → About Google Chrome to safeguard against potential remote attacks.
Security researchers and enterprises relying on Chrome‑based browsers should monitor for related exploitation attempts targeting outdated builds.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…