Google Chrome Update Fixes 12 High-Severity Vulnerabilities

Google has released an important Chrome security update that fixes 12 High-severity vulnerabilities across the browser’s graphics, JavaScript, audio, extension, certificate, and user interface components.

The Stable channel has moved to Chrome 150.0.7871.181 or 150.0.7871.182 for Windows and macOS. Linux users receive version 150.0.7871.181.

Google is rolling out the update over the coming days and weeks. Users should install it promptly and restart Chrome to activate the security fixes.

Chrome Update Fixes 12 High-Severity Security Flaws

According to the Chrome Stable channel release notes, the update addresses vulnerabilities in ANGLE, Chromecast, Extensions, Skia, V8, WebAudio, Certificate, UI, and GPU.

The patched issues include stack and heap memory problems, type confusion, integer overflow, insufficient input validation, and use-after-free vulnerabilities.

Google did not say that attackers were actively exploiting any of the vulnerabilities when it published the update on July 21, 2026.

CVE	Severity	Vulnerability	Component
CVE-2026-16413	High	Out-of-bounds write	ANGLE
CVE-2026-16414	High	Insufficient validation of untrusted input	Chromecast
CVE-2026-16415	High	Insufficient validation of untrusted input	Extensions
CVE-2026-16416	High	Integer overflow	Chromecast
CVE-2026-16417	High	Use of uninitialized memory	Skia
CVE-2026-16418	High	Stack buffer overflow	V8
CVE-2026-16419	High	Out-of-bounds read and write	ANGLE
CVE-2026-16420	High	Type confusion	WebAudio
CVE-2026-16421	High	Inappropriate implementation	WebAudio
CVE-2026-16422	High	Insufficient validation of untrusted input	Certificate
CVE-2026-16423	High	Use after free	UI
CVE-2026-16424	High	Use after free	GPU

V8 Buffer Overflow Could Allow Code Execution

One of the most serious fixes addresses CVE-2026-16418, a stack buffer overflow in Chrome’s V8 JavaScript engine.

The National Vulnerability Database entry states that a remote attacker could exploit the flaw using a specially crafted HTML page. Successful exploitation could allow arbitrary code execution inside Chrome’s sandbox.

V8 processes JavaScript and WebAssembly content loaded by websites. Vulnerabilities in the engine often attract attention because an attacker may trigger them after convincing a user to visit a malicious or compromised webpage.

ANGLE and GPU Flaws Affect Chrome Graphics Processing

The update fixes two vulnerabilities in ANGLE, the graphics translation layer used by Chrome. CVE-2026-16413 involves an out-of-bounds write, while CVE-2026-16419 involves an out-of-bounds read and write.

Google also patched CVE-2026-16424, a use-after-free vulnerability in Chrome’s GPU component. These flaws affect code that processes graphics operations and web content rendered through hardware acceleration.

Memory corruption vulnerabilities can cause browser crashes. Under suitable conditions, an attacker may also use them to alter program behavior or execute code within the affected process.

• Out-of-bounds writes can corrupt memory outside an intended buffer.
• Out-of-bounds reads may expose data stored in nearby memory.
• Use-after-free flaws access memory after the program has released it.
• Stack buffer overflows can overwrite data controlling program execution.
• Type confusion flaws cause software to process an object as the wrong type.

Chrome WebAudio Bugs Were Found by an AI Security System

Two WebAudio vulnerabilities, CVE-2026-16420 and CVE-2026-16421, were found by XBOW and triaged by security researcher Brendan Dolan-Gavitt.

CVE-2026-16420 involves type confusion, while CVE-2026-16421 concerns an inappropriate implementation in WebAudio. Google awarded a $500 bounty for each report.

WebAudio gives websites advanced tools for generating, processing, and controlling sound inside the browser. A malicious page could attempt to trigger implementation flaws by supplying unexpected audio data or operations.

Chrome Extensions and Certificates Also Received Fixes

CVE-2026-16415 affects the browser’s Extensions component and involves insufficient validation of untrusted input. Extension-related weaknesses can become important when they cross boundaries between websites, browser features, and installed add-ons.

Google also corrected CVE-2026-16422 in Chrome’s Certificate component. The flaw involved insufficient validation of untrusted input.

Certificate processing helps Chrome verify encrypted website connections. Validation errors in this area may weaken security checks or cause the browser to handle malformed certificate data incorrectly.

Skia and Chrome UI Contained Memory Safety Bugs

CVE-2026-16417 concerns the use of uninitialized memory in Skia, Chrome’s graphics library. Software may behave unpredictably when it reads memory before assigning a valid value.

CVE-2026-16423 is a use-after-free vulnerability in Chrome’s user interface component. Google discovered and reported both vulnerabilities internally.

The latest Google Chrome security update also includes two Chromecast fixes involving an integer overflow and insufficient validation of untrusted input.

Chrome component	Primary function	Patched risk
V8	Executes JavaScript and WebAssembly	Stack buffer overflow
ANGLE	Translates graphics instructions	Out-of-bounds memory access
Skia	Renders graphics, text, and images	Uninitialized memory use
WebAudio	Processes audio inside webpages	Type confusion and implementation error
GPU	Supports hardware-accelerated rendering	Use after free
Extensions	Runs installed browser add-ons	Insufficient input validation

Google Restricts Access to Technical Bug Details

Google has temporarily restricted access to detailed reports for several vulnerabilities. The company commonly limits this information until most users have installed the patched browser.

This approach reduces the amount of technical guidance available to attackers while vulnerable installations remain widespread.

Google may retain restrictions for longer when a vulnerability affects a shared third-party library that other software projects have not yet patched.

Automated Tools Help Google Find Chrome Vulnerabilities

Google credits several automated testing and code-hardening tools with identifying security problems during Chrome’s development.

These tools examine browser code for unsafe memory access, undefined behavior, unexpected inputs, and program execution paths that violate security controls.

Google listed the following technologies among the tools used to detect Chrome security bugs:

• AddressSanitizer
• MemorySanitizer
• UndefinedBehaviorSanitizer
• Control Flow Integrity
• libFuzzer
• American Fuzzy Lop

Could the Chrome Vulnerabilities Enable Browser Attacks?

Several vulnerabilities could support browser attacks if threat actors develop working exploits. An attacker would typically need to persuade a target to open a malicious webpage or visit a legitimate site containing compromised content.

For example, the CVE-2026-16418 vulnerability record confirms that crafted HTML content could trigger arbitrary code execution inside Chrome’s sandbox.

Browser sandboxes limit what compromised rendering processes can access. Attackers often need a second vulnerability to escape the sandbox and gain broader access to the operating system.

How to Install the Latest Google Chrome Update

Chrome normally downloads security updates automatically in the background. However, the browser does not fully apply a pending desktop update until the user restarts it.

Users can follow the official Chrome update instructions to check their installed version and trigger an update manually.

1. Open Google Chrome.
2. Click the three-dot menu in the upper-right corner.
3. Select Help.
4. Open About Google Chrome.
5. Wait while Chrome checks for and installs updates.
6. Click Relaunch to restart the browser.

The About Chrome page should display version 150.0.7871.181 or 150.0.7871.182 after the update, depending on the operating system and release build.

Enterprises Should Prioritize the Chrome Security Release

Enterprise administrators should check managed Windows, macOS, and Linux devices for outdated Chrome installations. Systems that remain open for long periods may have downloaded the update without restarting to apply it.

Administrators should use browser management tools to enforce updates, monitor installed versions, and set appropriate relaunch deadlines.

Google’s Chrome update guidance confirms that opening the About Google Chrome page starts an update check. Users must relaunch the browser when Chrome presents that option.

• Confirm the installed Chrome version across managed devices.
• Deploy the update through approved management systems.
• Require users to restart Chrome after installation.
• Investigate devices that cannot receive automatic updates.
• Remove unsupported operating systems from sensitive environments.

Google has not announced active exploitation of the 12 vulnerabilities. However, public disclosure gives attackers information that may help them compare patched and unpatched browser code.

Installing the update before exploit development advances provides the most reliable protection against the vulnerabilities addressed in this release.

FAQ