Google Chrome Emergency Update Fixes Four High-Severity Vulnerabilities
Google has released an emergency update for Chrome, patching four high-severity vulnerabilities including memory corruption flaws that could lead to code execution.
Google has issued an urgent security update for its widely-used Chrome browser, addressing four critical vulnerabilities that pose a significant risk to users. The update, which is rolling out globally, brings Chrome to version 150.0.7871.186 for Windows and macOS, and 150.0.7871.186 for Linux.
The focus of this release is squarely on security, with all four patched vulnerabilities classified as high severity. While Google has not disclosed extensive technical details to prevent exploitation, the flaws are primarily memory safety issues, a common target for attackers seeking to execute arbitrary code or compromise browser functionality.
One of the patched vulnerabilities, CVE-2026-16807, is an out-of-bounds write in Chrome's media codecs component. This type of vulnerability allows attackers to write data beyond the allocated memory buffer, potentially corrupting memory and enabling the execution of malicious code, especially when processing untrusted media content.
The remaining three vulnerabilities are use-after-free bugs. These memory corruption flaws occur when a program attempts to access memory after it has been deallocated. CVE-2026-16806 affects the WebMCP component, CVE-2026-16805 is located within the Blink rendering engine, and CVE-2026-16804 impacts the browser's input handling mechanisms. Exploiting these could lead to browser crashes, unexpected behavior, or even system compromise.
Use-after-free vulnerabilities are particularly concerning in complex environments like web browsers, which are constantly exposed to external content. Components such as the Blink rendering engine and input handlers are prime targets for attackers who can craft malicious web pages or content to trigger these flaws.
In line with its security protocols, Google is restricting access to detailed information about these vulnerabilities until a substantial portion of users have applied the update. This measure aims to mitigate the risk of these flaws being weaponized by malicious actors before widespread patching can occur.
Google attributes the discovery of these vulnerabilities to its internal security teams, underscoring the effectiveness of its ongoing investment in advanced security testing tools like AddressSanitizer, MemorySanitizer, and libFuzzer. These tools are instrumental in identifying memory safety issues early in the development cycle.
Although there is no current evidence of these specific vulnerabilities being exploited in the wild, their high severity rating and the nature of memory corruption bugs necessitate immediate action. Users are strongly advised to update their Chrome browsers as soon as possible. While most installations update automatically, users can manually check for updates via the browser's settings menu.