Chrome 150 Stable Update Fixes Four High-Severity Memory Bugs in Desktop Browsers

Google has pushed out a fresh Stable Channel update for Chrome Desktop, bumping the browser to version 150.0.7871.186/.187 on Windows and Mac and 150.0.7871.186 on Linux, with the rollout expected to continue over the coming days and weeks.

The release, announced Thursday, July 23, 2026, quietly patches four high-severity security vulnerabilities that could otherwise expose users to memory-corruption attacks capable of crashing the browser or enabling arbitrary code execution.

The update addresses a tightly clustered set of bugs, all rated High severity, spanning different corners of Chrome’s rendering and media stack. Security researchers tracking the release note that all four issues stem from memory-safety failures, the kind of low-level bugs that remain among the most exploited vulnerability classes in modern browsers.

Chrome 150 Stable Update Fixes Four High-Severity

CVE-2026-16807: Out-of-bounds write in Codecs, reported internally by Google on May 30, 2026
CVE-2026-16806: Use-after-free in WebMCP, reported by Google on June 10, 2026
CVE-2026-16805: Use-after-free in Blink, Chrome’s rendering engine, reported by Google on June 12, 2026
CVE-2026-16804: Use-after-free in Input handling, reported by Google on June 16, 2026

Notably, all four flaws were discovered internally by Google’s own security teams rather than external bug-bounty researchers, and no reward amounts were disclosed in the advisory, which contrasts with several recent Chrome updates that carried five- and six-figure bounty payouts.

Google has also kept technical bug details restricted, a standard practice it follows until a majority of the user base has installed the fix or until third-party library dependencies affected by the same flaw are patched elsewhere.

Three of the four vulnerabilities fall into the use-after-free category, a memory-corruption pattern where a program continues referencing memory after it has been freed, often letting attackers hijack that memory to run malicious code.

This mirrors a broader trend across Chrome’s 2026 release cycle, where prior updates including the massive 150.0.7871.46/.47 release in late June, which fixed nearly 400 flaws including 15 critical use-after-free issues, have repeatedly flagged this bug class as Chrome’s most persistent weakness.

Google credits its internal fuzzing and sanitizer infrastructure AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL for catching many of these bugs before they reach the Stable channel, underscoring how automated, continuous fuzz testing has become foundational to Chrome’s security posture.

Control Flow Integrity in particular works by converting invalid virtual-pointer accesses into non-exploitable crashes rather than silent corruption, effectively blunting attacker attempts to hijack program execution flow.

Given that use-after-free and out-of-bounds write bugs are frequently weaponized in real-world exploit chains, security teams are advising immediate updates rather than waiting for the automatic rollout.

Users can manually trigger the update via chrome://settings/help, and enterprise administrators should verify fleet-wide deployment, given Chrome’s dominant browser market share makes it a persistent target for threat actors.