Google Chrome Update Patches 18 Security Flaws, Including Critical WebGL and Autofill Vulnerabilities

Google has released Chrome version 149.0.7827.196/197 for Windows and macOS, and version 149.0.7827.196 for Linux. This update addresses 18 security vulnerabilities, including several critical memory safety flaws in the WebGL and Autofill components.

The announcement was made on June 23, 2026, and the update is being rolled out gradually over the coming days and weeks. Users are strongly advised to apply the patches immediately due to the risk of exploitation.

Google Chrome Update Patches Flaws

The most severe vulnerabilities include multiple use-after-free issues, a type of memory corruption bug that can allow attackers to execute arbitrary code within the browser. Notably, CVE-2026-13028 and CVE-2026-13032 affect WebGL, a widely used graphics API, making them particularly appealing for exploitation through malicious web content.

Another critical flaw, CVE-2026-13038, impacts Chrome’s Autofill component, which handles sensitive user data such as addresses and payment details, thereby increasing the potential impact of successful attacks.

In addition to these critical issues, Google also patched several high-severity vulnerabilities affecting core browser components, including the Blink rendering engine, GPU processing, Web Authentication, FileSystem, and DevTools.

Many of these bugs involve improper memory handling, such as the use of uninitialized memory and insufficient validation of untrusted input, which could lead to crashes, data leakage, or code execution.

List of all Patched CVEs

CVE ID	Severity	Vulnerability Type
CVE-2026-13028	Critical	Use-after-free
CVE-2026-13032	Critical	Use-after-free
CVE-2026-13033	Critical	Out-of-bounds read
CVE-2026-13038	Critical	Use-after-free
CVE-2026-13021	High	Inappropriate implementation
CVE-2026-13022	High	Inappropriate implementation
CVE-2026-13023	High	Uninitialized use
CVE-2026-13024	High	Insufficient validation of untrusted input
CVE-2026-13025	High	Insufficient validation of untrusted input
CVE-2026-13026	High	Use-after-free
CVE-2026-13027	High	Use-after-free
CVE-2026-13029	High	Use-after-free
CVE-2026-13030	High	Uninitialized use
CVE-2026-13031	High	Use-after-free
CVE-2026-13034	High	Inappropriate implementation
CVE-2026-13035	High	Use-after-free
CVE-2026-13036	High	Use-after-free
CVE-2026-13037	High	Use-after-free

Google noted that access to detailed bug reports and proof-of-concept exploit information remains restricted until a majority of users have updated their browsers. This is a standard practice aimed at reducing the likelihood of active exploitation.

The company also highlighted that many of these vulnerabilities were identified using advanced fuzzing and memory analysis tools, such as AddressSanitizer, libFuzzer, and AFL.

While there has been no public confirmation of active exploitation in the wild, the presence of multiple critical memory corruption flaws significantly increases risk.

Attackers typically chain together such vulnerabilities with sandbox-escape techniques to achieve full system compromise. Therefore, both enterprises and individual users should prioritize updating Chrome to the latest version and ensure that automatic updates are enabled.

Security researchers continue to play a vital role in identifying vulnerabilities. However, several of the flaws in this release were discovered internally by Google’s security teams. Users can check their browser version by navigating to Chrome Settings > About Chrome, which will also trigger the update process.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.