Google has released an urgent security update for its Chrome browser, addressing multiple vulnerabilities, including a zero-day flaw actively exploited in the wild. The update upgrades Chrome to version 149.0.7827.102/.103 on Windows and Mac, and to 149.0.7827.102 on Linux.
The tech giant confirmed that the zero-day vulnerability, tracked as CVE-2026-11645, involves an out-of-bounds memory access issue in the V8 JavaScript engine. Although classified as a high-severity flaw, its active exploitation significantly increases the risk, allowing attackers to execute arbitrary code via crafted web content.
Chrome Security Update
In total, Google patched 74 security vulnerabilities in this release, with a large portion categorized as critical severity. Most of these critical flaws stem from “use-after-free” memory corruption issues across various Chrome components, including Ozone, Bluetooth, TabStrip, Views, and Web Apps.
These vulnerabilities can lead to heap corruption and, if successfully exploited, could be leveraged for remote code execution.
Google has restricted detailed technical information about these vulnerabilities to prevent further exploitation until a majority of users have applied the update. The company also noted that some bugs may exist in third-party libraries, which could delay full disclosure.
Security researchers and internal teams reported the majority of the flaws in late May 2026. Google credited its advanced bug detection systems, including AddressSanitizer, MemorySanitizer, and libFuzzer, for identifying several of these issues during testing.
The presence of an actively exploited vulnerability highlights the urgency for users and organizations to update their browsers immediately. Threat actors often weaponize these flaws in drive-by download attacks or through malicious websites, leaving unpatched systems highly vulnerable.
Critical CVEs Patched
| CVE ID | Vulnerability Type | Component | Reported Date |
|---|---|---|---|
| CVE-2026-11628 | Use-after-free | Ozone | 2026-05-25 |
| CVE-2026-11629 | Use-after-free | Ozone | 2026-05-26 |
| CVE-2026-11630 | Use-after-free | File Input | 2026-05-26 |
| CVE-2026-11631 | Use-after-free | Aura | 2026-05-26 |
| CVE-2026-11632 | Use-after-free | TabStrip | 2026-05-26 |
| CVE-2026-11633 | Use-after-free | Bluetooth | 2026-05-27 |
| CVE-2026-11634 | Use-after-free | Gamepad | 2026-05-27 |
| CVE-2026-11635 | Use-after-free | Bluetooth | 2026-05-27 |
| CVE-2026-11636 | Use-after-free | Autofill | 2026-05-27 |
| CVE-2026-11637 | Use-after-free | Views | 2026-05-27 |
| CVE-2026-11638 | Use-after-free | Printing | 2026-05-27 |
| CVE-2026-11639 | Use-after-free | Compositing | 2026-05-27 |
| CVE-2026-11640 | Integer overflow | libyuv | 2026-05-28 |
| CVE-2026-11641 | Use-after-free | Bluetooth | 2026-05-28 |
| CVE-2026-11642 | Use-after-free | Web Apps | 2026-05-29 |
| CVE-2026-11643 | Use-after-free | Proxy | 2026-05-29 |
| CVE-2026-11644 | Use-after-free | Views | 2026-05-30 |
Users are strongly advised to update Chrome via Settings > About Chrome to ensure they are protected against these vulnerabilities. Organizations should prioritize patch management and monitor for any signs of exploitation, particularly related to the V8 engine flaw.
Given the scale and severity of the patched issues, this update is critical for maintaining browser security and preventing potential compromise.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
