Chrome Stable Channel Update: Fixes Critical Vulnerabilities

Google has released a particularly important security update for its Chrome browser , upgrading the Stable channel to version 149.0.7827.196/197 for Windows and macOS and to version 149.0.7827.196 for Linux . The update is classified as critical, as it fixes a total of 18 security vulnerabilities , four of which have received the maximum severity rating.

According to the company, several of the vulnerabilities could, under certain conditions, allow malicious actors to execute arbitrary code on affected systems, thus gaining the ability to take control of the browser or even affect the user's operating environment.

Focus on Use-after-Free vulnerabilities

The most serious fixes concern Use-after-Free (UAF) flaws in Chrome's WebGL rendering engine . These are vulnerabilities CVE-2026-13028 and CVE-2026-13032 , which were discovered in June, either by external security researchers or by Google's internal teams.

See also: CISA: Lantronix and Ubiquity vulnerabilities in the KEV Catalog

Use-after-Free errors occur when a program continues to use a memory area that has already been freed. If an attacker manages to exploit this condition, they can modify the execution flow of the application and execute malicious code on the victim's system.

This specific category of vulnerabilities has long been considered one of the most dangerous in the browser space, as it has been used repeatedly in real attacks that led to the installation of malicious software, data espionage, or even complete device compromise.

Problems in other critical subsystems as well

Beyond WebGL, Google has also addressed other critical vulnerabilities. CVE-2026-13033 concerns an Out-of-Bounds Read error in Blink's InterestGroups component , while CVE-2026-13038 fixes another Use-after-Free issue in the Autofill subsystem .

The update also addresses 14 high-severity vulnerabilitiesthat affect multiple parts of Chrome, including WebView, Bluetooth, and other critical mechanisms of the browser.

The concentration of so many serious bugs in different subsystems highlights the great complexity of a modern browser. Chrome is no longer a simple browsing tool, but a highly complex software platform that manages graphics, communications, payments, stored data and hundreds of web APIs.

See also: Vulnerability in macOS allows disabling of protection tools

Why browsers are a constant target for attackers

Web browsers have become one of the most important attack surfaces in cyberspace. Today, most users conduct their banking transactions, access cloud services, manage business data, and store personal information through their browsers.

This means that successfully exploiting a vulnerability in Chrome could give cybercriminals access to extremely valuable information. In some scenarios, compromising the browser could be the first step in a more complex attack, leading to credential theft, data exfiltration , or malware installation.

See also: Samsung KNOX: Eight-year-old vulnerability put Galaxy devices at risk

Google's strategy and the importance of immediate information

Google said technical details of the vulnerabilities would remain temporarily restricted until the patches are installed on the vast majority of devices, a standard cybersecurity practice that reduces the risk of attacks developing before users have a chance to update their systems .

It is also worth noting that many of the vulnerabilities were identified through internal fuzzing tools and technologies AddressSanitizer, MemorySanitizer, and libFuzzer, which demonstrates the importance of automated security checks in modern software development.

Experts recommend that users and administrators install the new version of Chrome immediately. The update can be done via Settings → Help → About Google Chrome, allowing the browser to automatically download and apply the latest security patches.