Google Patches 28 Chrome Vulnerabilities Allowing Remote Code Execution

Key Takeaways

• Google has released an urgent security update for its Chrome browser, addressing 28 vulnerabilities.
• Multiple critical flaws, including several use-after-free and heap buffer overflow issues, could enable remote code execution.
• All Chrome users on Windows, macOS, and Linux are affected and advised to update immediately.
• The update brings Chrome to version 149.0.7827.114/.115 for Windows/macOS and 149.0.7827.114 for Linux.

Google has rolled out a crucial security update for its Chrome web browser, addressing a total of 28 security vulnerabilities. This extensive patch includes fixes for several critical flaws that could be exploited by attackers to achieve remote code execution on vulnerable systems, posing a significant risk to user security.

The latest Stable channel release elevates Chrome to version 149.0.7827.114 or 149.0.7827.115 for users on Windows and macOS platforms, while Linux users will receive version 149.0.7827.114. Google is implementing this update progressively, meaning it will become available to the user base over the next several days and weeks. A comprehensive changelog detailing all modifications included in this release has been made public by the company.

Critical Flaws Pave Way for Remote Code Execution

Among the most severe issues addressed in this update are multiple critical memory corruption vulnerabilities. These include several use-after-free (UAF) flaws impacting fundamental Chrome components. Specifically, UAF vulnerabilities were identified in Core (CVE-2026-12007), DigitalCredentials (CVE-2026-12008), and WebMIDI (CVE-2026-12011).

Use-after-free vulnerabilities arise from improper memory management, where a program continues to use a pointer to memory that has already been deallocated. This can allow an attacker to manipulate the freed memory region, leading to unpredictable behavior or arbitrary code execution.

Furthermore, Google patched a critical heap buffer overflow vulnerability in the GPU component, tracked as CVE-2026-12010. Another significant fix addresses an insufficient validation of untrusted input flaw within the Accessibility component, identified as CVE-2026-12009. Exploitation of these vulnerabilities typically involves tricking users into visiting specially crafted web pages, which could result in arbitrary code execution and potentially a full compromise of the affected system.

High-Severity Issues Also Mitigated

Beyond the critical vulnerabilities, the update resolves a substantial number of high-severity issues spanning various Chrome components. Several of these are additional use-after-free vulnerabilities affecting modules such as Network, Media, Autofill, GPU, Video, and Views. These bugs are prime targets for memory corruption attacks and are frequently chained together in sophisticated exploits.

Other high-severity issues include out-of-bounds read and write vulnerabilities found in components like Codecs, Video, and VideoCapture. Such flaws can allow attackers to read or write data beyond the intended memory boundaries, leading to information disclosure or further memory corruption. A separate heap buffer overflow vulnerability in the GPU component was also patched, increasing the risk of successful exploitation.

The update also corrects multiple instances of insufficient validation of untrusted input across DevTools, Extensions, Network, and Linux Toolkit Theming. Additionally, Google addressed improper policy enforcement issues within DevTools and Headless mode, alongside a race condition vulnerability in Safe Browsing. These weaknesses could potentially be leveraged to bypass existing security restrictions or interfere with the browser’s protective mechanisms.

While Google has not yet confirmed any active exploitation of these vulnerabilities in the wild, the prevalence of memory-related flaws significantly elevates the potential for such attacks. Threat actors commonly exploit these types of vulnerabilities through malicious websites, exploit kits, or compromised advertising networks.

To mitigate immediate risk, Google has temporarily restricted public access to detailed vulnerability information. This strategy aims to prevent attackers from reverse-engineering patches to develop exploits before a majority of users have had the opportunity to update their browsers. Google acknowledged both its internal security teams and external researchers for their contributions in identifying and reporting these vulnerabilities.

The company also highlighted the effectiveness of advanced detection tools such as AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL in discovering and addressing security flaws during the development phase.

What You Should Do

• Update Immediately: Users are strongly advised to update Chrome to the latest version without delay.
• Verify Version: Although Chrome typically updates automatically, users can manually check their browser version via the Chrome settings menu to ensure they have the latest patch.
• Organizational Deployment: Enterprises and organizations should prioritize the rapid deployment of this patch across all managed systems to minimize exposure to potential threats.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.