Chrome 150 Update Patches 27 Flaws, Including 2 Critical Use-After-Free Bugs

Google has rolled out a critical Stable channel update for Chrome Desktop, pushing version 150.0.7871.114/.115 on Windows and Mac, and 150.0.7871.114 on Linux.

Released on July 8, 2026, the update addresses 27 security vulnerabilities, including two rated Critical severity that could allow attackers to execute arbitrary code on affected systems.

The rollout will continue across the coming days and weeks as it reaches the broader Chrome user base.

Chrome 150 Update Patches 27 Flaws

For a browser installed on billions of devices worldwide, this update carries significant weight. It underscores how deeply Chrome’s internal components, from rendering engines to input handling, remain persistent targets for memory corruption bugs.

The two Critical-rated vulnerabilities both stem from use-after-free conditions, a class of memory-safety bugs that continue to plague Chromium despite years of hardening efforts.

CVE-2026-15112 affects Ozone, Chromium’s platform abstraction layer for graphics and windowing, and was reported internally by Google on May 29, 2026.
CVE-2026-15129 affects the Views UI framework and was discovered internally on June 15, 2026.

Use-after-free bugs occur when a program continues to reference memory after it’s been freed, potentially allowing attackers to hijack that memory to execute malicious code.

Both flaws were caught through Google’s internal security research rather than external bug bounty submissions, highlighting the effectiveness of Chrome’s in-house fuzzing and sanitizer tooling.

The bulk of this release’s 19 vulnerabilities fall under the High severity category, touching an unusually broad swath of Chrome’s architecture: Extensions, ANGLE, Autofill, Codecs, WebAppInstalls, Payments, WebRTC, DOM, Passwords, Forms, WebGL, and Navigation.

Two High-severity issues came with bounty payouts. Pierre Langlois from Arm earned $500 for CVE-2026-15132, an uninitialized use bug in V8, Chrome’s JavaScript engine.

Jihyeon Jeong, a research intern at Seoul National University’s Compsec Lab, also received $500 for identifying CVE-2026-15133, a use-after-free in the InterestGroups API tied to Chrome’s Privacy Sandbox advertising infrastructure.

The remaining 17 High-severity fixes were discovered internally by Google, a pattern reflecting the company’s heavy investment in proactive vulnerability hunting across memory-unsafe code paths.

Two Medium-severity vulnerabilities complete the list. CVE-2026-15107, a use-after-free in IndexedDB, earned researcher zh1x1an1221 of Ant Group’s Tianqiong Security Lab a $2,000 reward, the largest bounty in this release. CVE-2026-15131, an insufficient data validation issue in Navigation, was found internally by Google.

Roughly two-thirds of this patch batch involves use-after-free or uninitialized memory issues, reinforcing a persistent trend in browser security.

Chrome’s codebase, written largely in C++, remains structurally exposed to memory safety flaws even as Google invests heavily in Rust migration efforts and sandboxing technologies.

Tools like AddressSanitizer, MemorySanitizer, and libFuzzer continue to catch many of these bugs before they reach production, but the sheer volume in this release shows that the attack surface remains extensive.

Google has withheld technical details for most of these CVEs, a standard practice that gives users time to update before proof-of-concept exploits circulate publicly.

Chrome typically updates automatically, but users can manually trigger the patch by navigating to Settings > About Chrome and restarting the browser once the update downloads.

Given the presence of two Critical-severity flaws, security teams managing enterprise Chrome deployments should prioritize verifying update compliance across their fleets rather than waiting for the staggered automatic rollout.