Chrome Security Update Fixes 26 Vulnerabilities Enabling Remote Malicious Code Execution

Google has released a critical security update for its Chrome desktop web browser, addressing 26 distinct vulnerabilities that could enable attackers to execute malicious code remotely.

The Stable channel update introduces versions 146.0.7680.153 and 146.0.7680.154 for Windows and macOS systems, while Linux environments will receive version 146.0.7680.153.

This substantial patch cycle is actively rolling out over the coming days and weeks, delivering essential protections against severe memory corruption flaws.

To ensure complete protection, users are strongly advised to restart their browsers immediately after the automatic download completes so the new security measures are fully applied.

Critical and High-Severity Flaws Addressed

This comprehensive security update patches three vulnerabilities rated as Critical, alongside 22 High-severity bugs and one Medium-severity issue.

The critical flaws involve an out-of-bounds memory access and an out-of-bounds read and write in the WebGL graphics component, as well as a severe use-after-free vulnerability in the Base component.

Many of the high-severity flaws, such as heap buffer overflows and integer overflows, affect core browser processing engines including WebRTC, V8, ANGLE, Blink, and WebAudio.

If left unpatched, these memory corruption vulnerabilities could allow unauthenticated remote attackers to compromise system integrity simply by tricking victims into visiting specially crafted web pages.

As part of its standard security protocol, Google heavily restricts public access to detailed bug reports and exploit chains until a vast majority of the user base has successfully applied the patch.

This delayed disclosure strategy successfully prevents opportunistic threat actors from reverse-engineering the patches to develop zero-day exploits targeting slow-to-update systems.

The company also maintains these strict data restrictions if a bug exists in a third-party library that other external projects depend on but have not yet fixed.

Individuals and enterprise organizations must prioritize timely security updates to defend against these sophisticated remote code execution threats.

Complete List of Patched Vulnerabilities

The following table details the specific security vulnerabilities addressed in this Chrome update.

Many of these severe security bugs were detected using internal security tools such as AddressSanitizer, MemorySanitizer, and Control Flow Integrity.

Google extended its thanks to all independent security researchers who worked during the development cycle to prevent these bugs from reaching the stable channel.

To ensure your browser is fully protected, navigate to the settings menu in Google Chrome, select the help section, and click on the “About Google Chrome” option to trigger the automatic update process.