The security of modern browsers is a key battleground for the technology industry, as browsers are the main gateway to the internet for billions of users. In this context, Google announced the release of a particularly important security update for its popular browser, Google Chrome, which fixes multiple serious security vulnerabilities.
Critical update for Chrome
The new update brings Chrome's Stable channel to version 145.0.7632.159/160 for Windows and macOS , while version 145.0.7632.159 is available for Linux . This update fixes a total of ten security vulnerabilities found in the browser.
Of these, three are rated as critical, making it particularly important for all users to install the update. As is usually the case with Chrome updates, the rollout is being done gradually and is expected to be completed in the coming days or weeks.
See also: Cisco Secure FMC: Vulnerability allows RCE attacks
The company released the update after responsible reports of the vulnerabilities were made by both independent security researchers and Google's internal teams. In several cases, researchers were rewarded through the program bug bounty , with amounts as high as $33,000 for a single report.
Chrome: The most serious vulnerabilities that were fixed
Among the issues addressed in the update are three critical security flaws. The first is CVE-2026-3536, which concerns an integer overflow in Chrome's ANGLE graphics layer. The vulnerability was discovered by researcher cinzinga, and he was awarded a $33,000 bounty.
The second critical issue, CVE-2026-3537 , is related to an object lifecycle error in the PowerVR subsystem and was reported by researcher Zhihua Yao of KunLun Lab. A bug bounty of $32,000 was awarded for this report.
The third critical vulnerability is CVE-2026-3538, which also concerns an integer overflow in the Skia graphics engine. It was reported by Symeon Paraschoudis on February 17.
These types of errors are considered particularly dangerous, as they can allow an attacker to execute malicious code on a user's computer simply through a malicious website.
See also: IPVanish VPN for macOS: Vulnerability allows privilege escalation
Seven more high severity vulnerabilities
In addition to the three critical security gaps, the update also addresses seven high-severity vulnerabilities. These affect different subsystems of Chrome, from V8 and WebAssembly to CSS and Navigation.
The bugs touch multiple technical levels of the browser, from graphics rendering via ANGLE, Skia and PowerVR systems, to JavaScript execution, audio management via WebAudio and video processing via WebCodecs.
This complexity also reflects the huge attack surface that modern browsers now have. Browsers essentially function as complete application platforms, executing complex code and handling numerous web standards.
| CVE ID | Severity | Component | Type | Reporter |
|---|---|---|---|---|
| CVE-2026-3536 | Critical | ANGLE | Integer Overflow | cinzinga |
| CVE-2026-3537 | Critical | PowerVR | Object Lifecycle Issue | Zhihua Yao, KunLun Lab |
| CVE-2026-3538 | Critical | Skia | Integer Overflow | Symeon Paraschoudis |
| CVE-2026-3539 | High | DevTools | Object Lifecycle Issue | Zhenpeng (Leo) Lin, depthfirst |
| CVE-2026-3540 | High | WebAudio | Inappropriate Implementation | Davi Antônio Cruz |
| CVE-2026-3541 | High | CSS | Inappropriate Implementation | Syn4pse |
| CVE-2026-3542 | High | WebAssembly | Inappropriate Implementation | qymag1c |
| CVE-2026-3543 | High | V8 | Inappropriate Implementation | qymag1c |
| CVE-2026-3544 | High | WebCodecs | Heap Buffer Overflow | c6eed09fc8b174b0f3eebedcceb1e792 |
| CVE-2026-3545 | High | Navigation | Insufficient Data Validation |
Why are the above vulnerabilities dangerous?
Integer overflow and heap buffer overflow are particularly dangerous vulnerabilities because they can lead to remote code execution or even a breach of the browser's security sandbox.
The sandbox is a fundamental protection mechanism of Chrome, as it limits the capabilities of websites to affect the rest of the system. If an attacker manages to bypass it, they could theoretically gain greater control over the user's computer.
See also: VMware Aria Operations vulnerability on CISA's KEV List
The tools Google uses for bug detection
Google invests heavily in automated bug detection in the Chrome development cycle. These tools include technologies such as AddressSanitizer, MemorySanitizer, libFuzzer, and AFL.
The tools are used to detect memory bugs and other potential vulnerabilities before the code reaches the stable channel of the browser. Despite extensive testing, however, the complexity of modern software makes the emergence of new security flaws almost inevitable.
What users should do
Security experts recommend that users install the latest Chrome update immediately. This can be easily done through the “About Google Chrome” option in the browser’s settings menu.
For corporate environments, system administrators should distribute the update through management policies to all corporate endpoints to reduce the risk of vulnerabilities being exploited.
Currently, Google has not reported any instances of active exploitation of these vulnerabilities. However, due to the severity of the vulnerabilities, immediate updating remains the safest choice for all Chrome users regardless of platform.
