Google Chrome: Four High-Severity Use-After-Free and Out-of-Bounds Write Flaws Patched Together
Google released an emergency update for Chrome on July 24, 2026, fixing four high-severity vulnerabilities including use-after-free and out-of-bounds write flaws.
Key findings
- Four high-severity vulnerabilities in Google Chrome were patched on July 24, 2026.
- The vulnerabilities include three 'Use after free' flaws and one 'Out of bounds write' flaw.
- Affected components include WebMCP, Blink, Codecs, and Input.
- The update addresses Chrome versions prior to 150.0.7871.186.
On July 24, 2026, Google released an emergency update for its Chrome browser, patching four high-severity vulnerabilities that were disclosed together. The vulnerabilities, all rated as high severity, could allow remote attackers to execute arbitrary code within a sandbox or perform a sandbox escape via crafted HTML pages.
The disclosed vulnerabilities include three instances of "Use after free" bugs and one "Out of bounds write" flaw.
CVE-2026-16806 and CVE-2026-16805 are both "Use after free" vulnerabilities, affecting the WebMCP and Blink components, respectively. These flaws could allow a remote attacker to execute arbitrary code inside a sandbox.
CVE-2026-16807, an "Out of bounds write" vulnerability in the Codecs component, could potentially allow a remote attacker to perform a sandbox escape.
CVE-2026-16804, another "Use after free" vulnerability, this time in the Input component, could allow an attacker who has already compromised the renderer process to potentially perform a sandbox escape.
These vulnerabilities were addressed in Chrome version 150.0.7871.186 for Windows and macOS, and 150.0.7871.186 for Linux systems. Users are strongly advised to update their Chrome browsers to the latest version to protect themselves from these security risks. While Google has not disclosed extensive technical details to prevent exploitation, the nature of these memory safety issues highlights the importance of timely patching.
The coordinated disclosure of these four high-severity flaws underscores the ongoing efforts to secure web browsers against sophisticated attacks. Users should remain vigilant and ensure their browsers are updated promptly to mitigate potential risks.