Google Rushes Out Critical Chrome Update to Address Serious PDFium and V8 Vulnerabilities
Google has released an essential security update for the Chrome browser, addressing three critical vulnerabilities that could allow attackers to execute unauthorized code on user devices.
Google has released an essential security update for the Chrome browser, addressing three critical vulnerabilities that could allow attackers to execute unauthorized code on user devices.
The update increases the Chrome versions to 145.0.7632.109/.110 for Windows and Mac, and 144.0.7559.109 for Linux.
Among the resolved issues are high-severity vulnerabilities within PDFium, the component responsible for PDF handling in Chrome, and V8, the high-performance JavaScript engine. These vulnerabilities could be exploited through malicious websites or documents.
PDFium vulnerabilities are associated with the processing of compromised PDFs, potentially leading to memory overflows and remote code execution. V8 vulnerabilities involve integer overflows that could interfere with numerical operations in web scripts, potentially bypassing security measures. The third vulnerability pertains to media playback, a frequent target for exploits.
The update increases the Chrome versions to 145.0.7632.109/.110 for Windows and Mac, and 144.0.7559.109 for Linux.
The identified vulnerabilities are currently classified as high risk, with Google withholding detailed information until the patch is more widely implemented.
CVE-2026-2648: High-severity heap buffer overflow in PDFium, potentially enabling remote code execution. CVE-2026-2649: High-severity integer overflow in V8, leading to heap structure corruption and potential remote code execution. CVE-2026-2650: Medium-severity heap buffer overflow in media buffers, particularly through malformed web videos or embeds.
According to Google's advisory , the vulnerabilities will remain confidential until a majority of users have updated their browsers. Google's internal security team identified the media-related issue using fuzzing tools like libFuzzer and AddressSanitizer.
Although Chrome's multi-process sandbox and site isolation features mitigate many attacks, these vulnerabilities underscore the importance of timely updates. Users are advised to update Chrome by navigating to Help > About Google Chrome, where updates are automatically checked and installed. Enterprises can deploy updates via Group Policy or MDM tools.
Based on reporting by GBHackers.
