Critical Chrome Flaws Let Attackers Execute Arbitrary Code

Google has released an urgent security update for its Chrome browser, resolving multiple dangerous vulnerabilities.

The Chrome team promoted version 147 to the stable channel for Windows, Mac, and Linux users on April 7, 2026.

This major release patches flaws that could allow attackers to execute arbitrary code and take full control of affected systems. The update is currently rolling out to all users globally over the coming days and weeks.

The most severe threats in this update are two critical vulnerabilities located in the WebML component. Tracked as CVE-2026-5858 and CVE-2026-5859, these flaws involve heap buffer and integer overflows.

Because of the high risk they pose, Google awarded massive $43,000 bug bounties to the security researchers who discovered them.

These critical bugs can be exploited simply by tricking a user into visiting a specially crafted webpage, making immediate patching absolutely essential.

Beyond the critical flaws, Chrome 147 addresses numerous high-severity bugs spread across several key browser components.

Security researchers found serious issues like use-after-free errors, type confusion, and out-of-bounds read and write flaws in the V8 JavaScript engine, WebRTC, Media, Blink, and Skia.

If exploited, these vulnerabilities could cause the browser to crash or allow malicious actors to compromise the underlying system.

Google paid tens of thousands of dollars in rewards to the ethical hackers who reported these issues to prevent them from falling into the wrong hands.

To protect users, Google will keep the technical details and exploit methods for these vulnerabilities strictly restricted.

This coordinated disclosure policy guarantees that the majority of the public has enough time to install the security patch before cybercriminals can reverse-engineer the fixes.

It also protects other software projects that depend on the same vulnerable third-party libraries, ensuring that the wider tech ecosystem remains secure while patches are developed and deployed.

Due to the severe nature of the WebML flaws, individuals and enterprise administrators are strongly advised to update their browsers immediately.

You can force the update manually by opening the Chrome menu, navigating to Help, and selecting About Google Chrome.

The browser will automatically download version 147.0.7727.55 for Linux or 147.0.7727.55/56 for Windows and Mac, securing your device against potential cyberattacks.

Chrome 147 Security Fixes