Chromium: Seven High Severity Vulnerabilities Patched in Same-Day Disclosure
Key findings • Seven High severity vulnerabilities disclosed together in Chromium on July 22, 2026. • Flaws impact Extensions, UI, GPU, Certificate handling, WebAudio, and ANGLE components. …
Key findings
- Seven High severity vulnerabilities disclosed together in Chromium on July 22, 2026.
- Flaws impact Extensions, UI, GPU, Certificate handling, WebAudio, and ANGLE components.
- Vulnerabilities include input validation errors, use-after-free, and out-of-bounds writes.
- Potential impacts range from URL spoofing to arbitrary code execution and sandbox escapes.
- Patched versions are 150.0.7871.181 (Linux) and 150.0.7871.182 (Windows/Mac).
On July 22, 2026, Google released a critical security update for its Chromium browser, patching a batch of seven High severity vulnerabilities disclosed on the same day. These vulnerabilities span various components of the browser, including Extensions, UI, GPU, Certificate handling, WebAudio, and ANGLE graphics. The disclosures highlight ongoing security challenges in complex software like web browsers, where flaws can lead to serious impacts such as arbitrary code execution, sandbox escapes, and domain spoofing.
Several of the vulnerabilities stem from insufficient validation of untrusted input. CVE-2026-16415 specifically points to issues in the Extensions component, potentially allowing a remote attacker to spoof the URL bar contents. Similarly, CVE-2026-16422 in the Certificate handling component could enable domain spoofing via malicious network traffic for an attacker in a privileged network position.
Memory corruption vulnerabilities were also prominent in this batch. CVE-2026-16423 and CVE-2026-16424 describe Use After Free bugs in the UI and GPU components, respectively. These could lead to heap corruption or even a sandbox escape if a user is tricked into specific UI gestures or if an attacker compromises the renderer process.
Further impacting the browser's security were issues within the WebAudio component. CVE-2026-16421, an inappropriate implementation, and CVE-2026-16420, a type confusion bug, both allowed remote attackers to execute arbitrary code within the browser's sandbox. Additionally, CVE-2026-16413, an out-of-bounds write in the ANGLE graphics component, also presented a potential path for sandbox escape.
All seven vulnerabilities were addressed in Google Chrome versions 150.0.7871.181 (for Linux) and 150.0.7871.182 (for Windows and Mac). Users are strongly urged to update their browsers immediately to mitigate the risks associated with these High severity flaws. The swift patching and coordinated disclosure underscore the importance of timely updates to protect against potential exploitation.
This coordinated disclosure of seven High severity vulnerabilities serves as a reminder of the continuous security efforts required to maintain the integrity of widely used software like Chromium. Users should remain vigilant and ensure their browsers are updated promptly to benefit from these security enhancements and protect against potential attacks. The variety of affected components—from UI and extensions to core graphics and audio processing—illustrates the broad attack surface within a modern web browser.