Chrome Security Update Fixes 8 Vulnerabilities Allowing Remote Code Execution
Google has released a critical security update for the Chrome browser to address eight high-severity vulnerabilities. These vulnerabilities, if exploited, could allow remote code execution, posing a significant risk to user data and system integrity.
Google has released a critical security update for the Chrome browser to address eight high-severity vulnerabilities. These vulnerabilities, if exploited, could allow remote code execution, posing a significant risk to user data and system integrity.
The update is being rolled out to the stable channel, with versions 146.0.7680.164 or 146.0.7680.165 available for Windows and macOS users. Linux users will receive version 146.0.7680.164. The update is expected to reach all users over the coming days and weeks.
The latest patches address several memory management and processing errors in Chrome's architecture. This includes "Use-After-Free" vulnerabilities in components such as Dawn, WebGPU, and FedCM. These flaws occur when a program continues to use a memory pointer after the memory has been freed, potentially allowing attackers to execute malicious payloads.
Additionally, Google has resolved heap buffer overflows in WebAudio and WebGL, out-of-bounds reading flaws in CSS, and an integer overflow in the Fonts component. These vulnerabilities, when exploited, could allow attackers to bypass browser security sandboxes and compromise the host machine.
Google has released a critical security update for the Chrome browser to address eight high-severity vulnerabilities.
Google utilizes advanced testing tools like AddressSanitizer, MemorySanitizer, and libFuzzer to detect complex security bugs before reaching the stable channel.
High-Severity Vulnerabilities Addressed
CVE-2026-4673: WebAudio - Heap buffer overflow CVE-2026-4674: CSS - Out of bounds read CVE-2026-4675: WebGL - Heap buffer overflow CVE-2026-4676: Dawn - Use after free CVE-2026-4677: WebAudio - Out of bounds read CVE-2026-4678: WebGPU - Use after free CVE-2026-4679: Fonts - Integer overflow CVE-2026-4680: FedCM - Use after free
To protect users, Google restricts access to specific technical bug details and exploit links until most users can install the security update. This practice helps prevent threat actors from reverse-engineering the patch to launch attacks. Google also restricts information if a vulnerability exists in a third-party library used by other software projects.
The company rewards researchers for disclosing threats responsibly, offering a confirmed $7,000 bounty for the WebAudio vulnerability, with other rewards to be determined.
It is crucial for cybersecurity professionals and users to apply this update immediately. To ensure protection against potential remote code execution threats, navigate to the Chrome menu, select "Help," and click on "About Google Chrome" to check for the latest version and automatically download the security patch. Administrators should push the update through patch management systems to secure network endpoints efficiently.
Based on reporting by Cyber Security News.
