Critical Chrome RCE Flaws Patched

Key Takeaways

• Google has released an urgent security update for its Chrome browser, addressing 16 vulnerabilities.
• Two critical remote code execution (RCE) flaws, CVE-2026-9111 and CVE-2026-9110, pose the highest risk.
• The update brings Chrome to version 148.0.7778.178/179 for Windows and Mac, and 148.0.7778.178 for Linux.
• Users are strongly advised to update immediately to mitigate potential exploitation risks.

Chrome Update Addresses Critical RCE Vulnerabilities

Google has rolled out a crucial security update for its Chrome web browser, addressing a total of 16 vulnerabilities. The patch targets two critical flaws that could enable remote code execution (RCE) on affected systems, alongside numerous high and medium-severity issues.

The updated Stable channel versions are 148.0.7778.178/179 for Windows and Mac users, and 148.0.7778.178 for Linux. Google anticipates the update will reach all users within the coming days.

Critical Vulnerabilities Detailed

The two most severe vulnerabilities, both internally reported by Google on April 20, 2026, carry a Critical severity rating:

• CVE-2026-9111: This is a Use-After-Free vulnerability within WebRTC. Attackers could exploit this flaw by crafting a malicious web page, leading to memory corruption and ultimately remote code execution.
• CVE-2026-9110: Described as an “Inappropriate Implementation” flaw in the UI component. This vulnerability could allow threat actors to bypass existing security restrictions or spoof elements of the browser’s interface.

Use-After-Free vulnerabilities are particularly dangerous as they allow attackers to manipulate memory regions after they have been deallocated. This manipulation often serves as a critical step in chaining exploits to achieve full system compromise.

High-Severity Flaws Patched

In addition to the critical issues, Google’s latest update resolves nine high-severity vulnerabilities across various components:

Notably, CVE-2026-9112 and CVE-2026-9113 were disclosed by an external researcher known as c6eed09fc8b174b0f3eebedcceb1e792, who received a combined bounty of $14,000 for their findings.

Medium-Severity Issues Addressed

The update also includes fixes for five medium-severity issues. These include two out-of-bounds read vulnerabilities in the GPU component (CVE-2026-9121 and CVE-2026-9122), with credit given to David Korczynski of Adalogics and the aforementioned external researcher. Additionally, a heap buffer overflow in Chromecast (CVE-2026-9123), insufficient input validation (CVE-2026-9124), and a use-after-free bug in DOM (CVE-2026-9126) have been resolved.

What You Should Do

Google has stated that details concerning these bugs will remain restricted until a majority of users have updated their browsers. This measure aims to reduce the window of opportunity for potential exploitation during the rollout period. Users and administrators should take immediate action:

• Verify your Chrome browser version by navigating to chrome://settings/help and ensure it is 148.0.7778.178 or newer.
• Restart Chrome to apply any pending updates.
• Enterprise administrators should utilize policy management tools to expedite the deployment of this critical update across their networks.
• Stay informed by monitoring official Chrome release notes via the Google Chrome Releases blog and CISA advisories for any indicators of active exploitation.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.