Google Releases Emergency Chrome Update to Fix 10 Security Vulnerabilities
Google has issued a security update for Chrome, advancing the Stable channel to version 145.0.7632.159/160 for Windows and Mac, and 145.0.7632.159 for Linux. This update addresses 10 security vulnerabilities, three of which are classified as Critical.…
Google has issued a security update for Chrome, advancing the Stable channel to version 145.0.7632.159/160 for Windows and Mac, and 145.0.7632.159 for Linux. This update addresses 10 security vulnerabilities, three of which are classified as Critical. The update will be distributed to users over the upcoming days and weeks.
The vulnerabilities were disclosed by independent security researchers and Google’s internal teams, with bug bounty rewards up to $33,000 for individual flaws. Users are advised to update their browsers promptly, as detailed information about the vulnerabilities will remain confidential until a majority of users have received the update.
Critical and High-Severity Vulnerabilities
Among the ten vulnerabilities, three have been rated as Critical. The key vulnerability, CVE-2026-3536, is an integer overflow in Chrome's ANGLE graphics layer, reported by researcher cinzinga on February 18, 2026, earning a $33,000 bounty.
Another critical flaw, CVE-2026-3537, involves an object lifecycle issue in PowerVR, reported by Zhihua Yao of KunLun Lab on January 8, with a reward of $32,000. The third critical vulnerability, CVE-2026-3538, is an integer overflow in the Skia graphics engine, reported by Symeon Paraschoudis on February 17.
The remaining seven vulnerabilities are rated High severity, affecting various Chrome subsystems, including V8, WebAssembly, CSS, and Navigation.
CVE ID Severity Component Type Reporter
CVE-2026-3536 Critical ANGLE Integer Overflow cinzinga
CVE-2026-3537 Critical PowerVR Object Lifecycle Issue Zhihua Yao, KunLun Lab
This update addresses 10 security vulnerabilities, three of which are classified as Critical.
CVE-2026-3538 Critical Skia Integer Overflow Symeon Paraschoudis
CVE-2026-3539 High DevTools Object Lifecycle Issue Zhenpeng (Leo) Lin, depthfirst
CVE-2026-3540 High WebAudio Inappropriate Implementation Davi Antônio Cruz
CVE-2026-3541 High CSS Inappropriate Implementation Syn4pse
CVE-2026-3542 High WebAssembly Inappropriate Implementation qymag1c
CVE-2026-3543 High V8 Inappropriate Implementation qymag1c
CVE-2026-3544 High WebCodecs Heap Buffer Overflow c6eed09fc8b174b0f3eebedcceb1e792
CVE-2026-3545 High Navigation Insufficient Data Validation Google
The range of affected components, such as graphics rendering (ANGLE, Skia, PowerVR), JavaScript execution (V8), and multimedia (WebAudio, WebCodecs), along with web standards (CSS, WebAssembly), highlights the extensive attack surface of modern browsers, as noted in the Google advisory .
Particularly, integer overflow and heap buffer overflow bugs are often exploited for remote code execution or sandbox escapes. Google employs automated detection tools like AddressSanitizer, MemorySanitizer, libFuzzer, and AFL to identify memory safety issues before they reach the stable channel.
Update Chrome immediately by navigating to Settings → Help → About Google Chrome . Enterprise admins should deploy the update via policy to all managed endpoints. Monitor the Chrome Security Page for complete CVE disclosures once the rollout is finished. Report new issues directly through crbug.com.
Currently, Google has not indicated any evidence of active exploitation of these vulnerabilities, but due to their Critical ratings, timely patching is essential for all Chrome users across platforms.
Based on reporting by Cyber Security News.