Google Chrome 150 Update Fixes Four High-Severity Security Vulnerabilities

Google Chrome version 150.0.7871.186 has addressed four high-severity vulnerabilities that affect core browser components, including Codecs, WebMCP, Blink, and Input.

While Google has not reported any evidence indicating that these vulnerabilities are actively being exploited, the company has restricted access to technical bug reports and related information until a majority of Chrome users receive the update.

This is a standard practice aimed at reducing the risk of vulnerabilities being weaponized before a widespread patch adoption occurs.

Google Chrome 150 Update

The most critical issue, identified as CVE-2026-16807, is an out-of-bounds write vulnerability in the Codecs component of Chrome. Google reported this flaw internally on May 30, 2026.

Out-of-bounds write bugs happen when software writes data beyond the limits of a memory buffer. In browser environments, such memory corruption issues can lead to application instability and, under certain circumstances, can potentially be exploited by attackers to execute code within the browser process.

Chrome version 150.0.7871.186 also resolves three use-after-free vulnerabilities. CVE-2026-16806 affects WebMCP and was reported by Google on June 10, 2026. CVE-2026-16805 is a use-after-free flaw in Blink, the browser’s rendering engine, reported on June 12. The final issue, CVE-2026-16804, impacts the Input component and was reported on June 16.

A use-after-free vulnerability arises when software continues to access memory after it has been released, potentially allowing attackers to manipulate program behavior or trigger memory corruption.

Vulnerabilities in the Blink component can be particularly significant because it processes web content and manages interactions between web pages, scripts, and browser rendering functions.

Meanwhile, flaws in media codecs or input-handling functionality could be triggered by malicious or specially crafted web content, depending on the specific code paths and conditions necessary for exploitation. Google has not yet disclosed the attack vectors, proof-of-concept details, or exploitability conditions for the four identified vulnerabilities.

The absence of external researcher rewards in Google’s advisory suggests that these vulnerabilities were found internally. Google credited its security engineering efforts and automated testing technologies, including AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL.

These tools help detect unsafe memory operations, undefined behavior, and code-flow weaknesses during Chrome development and testing.

Administrators can verify the installed Chrome version by navigating to the Chrome menu, selecting Help, and then About Google Chrome.

This action triggers an update check and prompts a browser relaunch when necessary. Enterprise teams should prioritise deploying updates through managed update policies, especially on systems that handle sensitive data or operate in high-risk environments.

Users should also restart Chrome after the update is downloaded, as a downloaded patch does not take effect until the browser is relaunched.

Google’s full changelog for Chrome version 150.0.7871.186 is available through the Chromium source repository. As additional vulnerability details may be released after broader patch adoption, defenders are advised to monitor Chrome’s security advisories and CVE records for further technical information.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.