Google has released a Chrome security update that addresses 12 high-severity vulnerabilities affecting various components, including WebAudio, ANGLE, Chromecast, extensions, Skia, the V8 JavaScript engine, certificate handling, the user interface, and GPU elements.
Many of these vulnerabilities involve memory corruption issues, such as out-of-bounds reads and writes, use-after-free bugs, stack buffer overflows, and type confusion. Attackers commonly exploit these flaws to gain code execution, bypass security boundaries, or cause browser crashes.
Google Chrome Update Fixes 12 Flaws
The Stable Channel release is version 150.0.7871.181/.182 for Windows and macOS, while Linux users will receive version 150.0.7871.181. Administrators should prioritize deploying this update across managed devices, especially those that access untrusted websites, web applications, external documents, or embedded browser content.
Users can manually check their installed version by navigating to Chrome Menu → Help → About Google Chrome, which will trigger the update process and often require a browser restart to activate the patched version.
Two externally reported vulnerabilities affecting the WebAudio API have been identified: CVE-2026-16420, which involves type confusion, and CVE-2026-16421, related to an improper implementation in WebAudio.
These vulnerabilities were found by XBOW and triaged by Brendan Dolan-Gavitt, with Google awarding $500 for each report. Type confusion can occur when software misinterprets an object as an incompatible type, potentially allowing attackers to manipulate memory unexpectedly.
The other vulnerabilities, reported internally by Google, impact critical rendering and execution pathways. The update resolves an out-of-bounds write and a separate out-of-bounds read-and-write flaw in ANGLE, which is Chromium’s graphics translation layer.
It also addresses a stack buffer overflow in V8, Chrome’s JavaScript and WebAssembly engine, in addition to use-after-free vulnerabilities in the user interface and GPU components.
Such vulnerabilities can be particularly dangerous since attacker-controlled web content may exploit affected code through JavaScript, graphics operations, media processing, or specially crafted web pages.
While Google has not confirmed any active exploitation of the 12 vulnerabilities in the wild, the company has restricted the disclosure of specific bug details and issue links until most Chrome users have received the update.
This is a standard defensive measure aimed at reducing the window for potential exploitation before the adoption of the patch increases. Additionally, restrictions may remain in place if a vulnerability impacts third-party components that require coordinated remediation.
| CVE | Severity | Vulnerability Type | Affected Component | Reporter |
|---|---|---|---|---|
| CVE-2026-16413 | High | Out-of-bounds write | ANGLE | |
| CVE-2026-16414 | High | Insufficient validation of untrusted input | Chromecast | |
| CVE-2026-16415 | High | Insufficient validation of untrusted input | Extensions | |
| CVE-2026-16416 | High | Integer overflow | Chromecast | |
| CVE-2026-16417 | High | Uninitialized use | Skia | |
| CVE-2026-16418 | High | Stack buffer overflow | V8 | |
| CVE-2026-16419 | High | Out-of-bounds read and write | ANGLE | |
| CVE-2026-16420 | High | Type confusion | WebAudio | XBOW |
| CVE-2026-16421 | High | Inappropriate implementation | WebAudio | XBOW |
| CVE-2026-16422 | High | Insufficient validation of untrusted input | Certificate | |
| CVE-2026-16423 | High | Use-after-free | UI | |
| CVE-2026-16424 | High | Use-after-free | GPU |
Google credited its security hardening and bug-finding initiatives, including AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL, for helping identify security defects during development.
Organizations are advised to enforce rapid browser patching, verify version compliance through endpoint management tools, and ensure that Chromium-based browsers receive vendor-specific updates as necessary.
ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
