Google Chrome Update Patches 27 Security Vulnerabilities Including Critical Use-After-Free Flaws

Google has released a critical security update for Chrome, upgrading the Stable channel to version 150.0.7871.114/.115 on Windows and macOS, and to version 150.0.7871.114 on Linux.

This update addresses 27 vulnerabilities, including several critical use-after-free flaws that could potentially enable remote code execution. The update will roll out gradually over the coming days and weeks, and users are strongly advised to apply patches immediately due to the severity of these issues.

Google Chrome Patches 27 Security Vulnerabilities

The most critical vulnerabilities include CVE-2026-15112 in Ozone and CVE-2026-15129 in Views, both stemming from use-after-free conditions. This class of memory corruption bugs is frequently exploited by attackers to execute arbitrary code within the browser context.

The majority of patched flaws are categorized as high severity and primarily involve memory-safety issues, such as use-after-free errors, uninitialized memory, and insufficient validation of untrusted input.

Affected components include core browser subsystems such as V8, WebRTC, Autofill, Extensions, and DOM handling, demonstrating the extensive attack surface in modern browsers.

Furthermore, several vulnerabilities in media processing components (such as Codecs and WebGL) and user interaction features (such as Forms, Passwords, and Navigation) highlight the risk of exploitation through specially crafted web content.

Security researchers and internal Google teams reported these issues between April and June 2026, and some external contributors received bug bounty rewards. Google has limited detailed technical disclosures for several vulnerabilities until the majority of users have updated to mitigate the risk of active exploitation.

The company has also emphasized the importance of advanced fuzzing and memory-safety tools, such as AddressSanitizer, MemorySanitizer, libFuzzer, and AFL, for identifying these flaws throughout the development lifecycle.

From an exploitation perspective, use-after-free vulnerabilities are particularly dangerous because they can be leveraged to corrupt the heap, potentially leading to sandbox escapes or full system compromise when combined with other bugs.

The presence of multiple such flaws in key rendering and UI components increases the urgency of patch deployment across both enterprise and consumer environments. Organizations using Chromium-based browsers should prioritize patch management and consider enforcing automatic updates where possible.

Below is a structured overview of the disclosed CVEs included in this release:

CVE ID	Severity	Vulnerability type	Affected component	Reporter / Organization	Reward
CVE-2026-15112	Critical	Use-after-free	Ozone	Google	N/A
CVE-2026-15129	Critical	Use-after-free	Views	Google	N/A
CVE-2026-15132	High	Uninitialized use	V8	Pierre Langlois, Arm	$500
CVE-2026-15133	High	Use-after-free	InterestGroups	Jihyeon Jeong (Compsec Lab, SNU / Research Intern)	$500
CVE-2026-15108	High	Integer overflow	Extensions API	Google	N/A
CVE-2026-15109	High	Uninitialized use	ANGLE	Google	N/A
CVE-2026-15110	High	Use-after-free	Extensions	Google	N/A
CVE-2026-15111	High	Use-after-free	Views	Google	N/A
CVE-2026-15113	High	Use-after-free	Autofill	Google	N/A
CVE-2026-15114	High	Out-of-bounds read/write	Codecs	Google	N/A
CVE-2026-15115	High	Insufficient validation of untrusted input	WebAppInstalls	Google	N/A
CVE-2026-15116	High	Use-after-free	Actor	Google	N/A
CVE-2026-15117	High	Use-after-free	Payments	Google	N/A
CVE-2026-15118	High	Use-after-free	Input	Google	N/A
CVE-2026-15119	High	Inappropriate implementation	GetUserMedia	Google	N/A
CVE-2026-15120	High	Use-after-free	Core	Google	N/A
CVE-2026-15121	High	Use-after-free	WebRTC	Google	N/A
CVE-2026-15122	High	Insufficient validation of untrusted input	Codecs	Google	N/A
CVE-2026-15123	High	Insufficient data validation	DOM	Google	N/A
CVE-2026-15124	High	Insufficient policy enforcement	Passwords	Google	N/A
CVE-2026-15125	High	Inappropriate implementation	Forms	Google	N/A
CVE-2026-15126	High	Use-after-free	Forms	Google	N/A
CVE-2026-15127	High	Inappropriate implementation	WebGL	Google	N/A
CVE-2026-15128	High	Inappropriate implementation	Forms	Google	N/A
CVE-2026-15130	High	Insufficient policy enforcement	Navigation	Google	N/A
CVE-2026-15107	Medium	Use-after-free	IndexedDB	zh1x1an1221, Ant Group Tianqiong Security Lab	$2000
CVE-2026-15131	Medium	Insufficient data validation	Navigation	Google	N/A

Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN