Potheeswaran 
Google has rolled out a fresh Stable channel update for Chrome Desktop, addressing seven security vulnerabilities, including three critical-severity use-after-free bugs that could allow attackers to execute arbitrary code on affected systems.
The update, pushed to version 150.0.7871.128/.129 for Windows and Mac, and 150.0.7871.128 for Linux, began rolling out on July 16, 2026, and will reach the broader user base over the coming days and weeks.
Given the presence of multiple critical-rated memory corruption flaws, security teams and everyday users alike should prioritize updating their browsers as soon as the patch becomes available.
Chrome 150 Update Patches 3 Critical Use-After-Free Flaws
Three of the seven fixed bugs carry Google’s “Critical” severity rating, all rooted in use-after-free conditions, a class of memory safety bug that occurs when software continues referencing memory after it has been freed, often letting attackers hijack that memory to run malicious code.
- CVE-2026-15899: Use-after-free in CameraCapture, reported by Google’s internal team on May 27, 2026
- CVE-2026-15900: Use-after-free in GPU, reported by Google on June 14, 2026
- CVE-2026-15901: Use-after-free in Network, reported by Google on July 10, 2026
The GPU and Network components are particularly sensitive attack surfaces since they handle low-level rendering and data transmission, making exploitation potentially easier to weaponize into remote code execution chains.
Four High-severity vulnerabilities round out this release:
- CVE-2026-15902: Use-after-free in Cast (reported June 10, 2026)
- CVE-2026-15903: Out-of-bounds read/write in V8, Chrome’s JavaScript engine, notably reported by OpenAI Codex Security researcher “amyb” on July 6, 2026
- CVE-2026-15904: Use-after-free in Ozone (reported July 9, 2026)
- CVE-2026-15905: Use-after-free in Aura (reported July 9, 2026)
The V8 bug stands out for two reasons: out-of-bounds read/write flaws in the JavaScript engine have historically been favored targets for exploit chains, and the reporting credit to an AI-focused security research team signals the growing involvement of AI-driven tooling in vulnerability discovery.
Google noted that many of these bugs were caught internally using automated memory-safety tooling, including AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL.
This layered fuzzing and sanitization approach reflects Chrome’s broader “defense-in-depth” philosophy, catching memory corruption issues before they reach production, though this cycle shows external researchers, including AI-assisted teams, remain critical to catching what internal tooling misses.
Bug details for most entries remain restricted (“N/A” or “TBD” access) until patch adoption reaches critical mass, a standard Google practice to prevent active exploitation before fixes propagate. Users should:
- Verify Chrome auto-updates or manually trigger an update via Settings > About Chrome
- Restart the browser immediately after updating to apply the patch
- Enterprise administrators should prioritize rapid deployment given the critical severity ratings
With three critical use-after-free bugs in active circulation and no confirmed in-the-wild exploitation disclosed yet, this update underscores the continuous cat-and-mouse dynamic between browser vendors and memory-safety threats.
About the Author
