Critical Chrome Vulnerabilities Allow Attackers to Execute Arbitrary Code

Google has released a critical security update for its Chrome browser, addressing multiple high-severity vulnerabilities that could allow attackers to execute arbitrary code on affected systems.

Users are strongly advised to update immediately as several flaws impact core browser components.

The latest Chrome Stable channel has been updated to version 149.0.7827.155/.156 for Windows and macOS, and 149.0.7827.155 for Linux.

The rollout is gradual and will reach users over the coming days and weeks. This release includes 33 security fixes, several of which are rated critical due to their potential for remote code execution (RCE).

Google has restricted detailed technical information for some bugs until the majority of users have installed the update.

Chrome Vulnerabilities Enable Code Execution

Among the patched issues, seven critical vulnerabilities stand out, primarily involving “use-after-free” memory corruption bugs. These flaws can allow attackers to manipulate memory and execute arbitrary code within the browser context.

Key critical vulnerabilities include:

CVE-2026-12437: Use-after-free in WebShare.

CVE-2026-12438: Inappropriate implementation in WebView.

CVE-2026-12439 & CVE-2026-12440: Use-after-free in Digital Credentials.

CVE-2026-12441: Use-after-free in File Input.

CVE-2026-12442: Use-after-free in Passwords.

CVE-2026-12443: Use-after-free in Web Authentication.

Use-after-free vulnerabilities occur when memory is accessed after it has been released, potentially allowing attackers to corrupt memory structures and gain control of the execution flow.

In a real-world scenario, a victim simply visiting a malicious webpage could trigger exploitation without additional interaction. In addition to critical flaws, Google patched numerous high-severity vulnerabilities across components such as WebRTC, Extensions, Safe Browsing, GPU, and File System Access.

Other Notable Vulnerabilities

Heap buffer overflows in WebRTC (CVE-2026-12447, CVE-2026-1246. Out-of-bounds reads in Chromoting and WebRTC.

Multiple use-after-free flaws in Extensions, Media, Downloads, and Browser. Insufficient validation and policy enforcement issues across input handling and extensions.

These vulnerabilities could lead to data leaks, sandbox escapes, or further exploitation chains when combined with other bugs.

Google credits its internal security tools for identifying many of these vulnerabilities, including AddressSanitizer, MemorySanitizer, libFuzzer, and Control Flow Integrity mechanisms.

These tools play a key role in proactively identifying memory safety issues before they are exploited in the wild.

Users and organizations should take immediate action: Update Chrome to the latest version via Settings > About Chrome. Restart the browser to ensure patches are applied.

Monitor enterprise environments for outdated browser versions. Apply defense-in-depth strategies such as endpoint protection and browser isolation.

Given the number of critical memory corruption vulnerabilities, delaying updates significantly increases the risk of exploitation.

CISO & Security Leaders: Your next breach may not have a face. Join ISC2’s LIVE webinar, “Ghost in the Machine”