Google Rolls Out Emergency Chrome Update for Four High-Severity Security Flaws

Google has released an emergency security update for its Chrome browser, addressing four high-severity vulnerabilities that could expose users to serious risks if left unpatched.

The update, now rolling out globally, upgrades Chrome to version 150.0.7871.186/.187 for Windows and macOS, and 150.0.7871.186 for Linux systems.

The latest release focuses primarily on security fixes, with Google confirming that all four vulnerabilities are rated as high severity. While technical details remain limited to prevent active exploitation, the flaws involve memory safety issues that attackers commonly exploit to achieve code execution or browser compromise.

Among the patched issues, CVE-2026-16807 is an out-of-bounds write vulnerability in Chrome’s media codecs component that could allow attackers to corrupt memory and execute arbitrary code by writing data outside allocated memory boundaries, making it particularly dangerous when processing untrusted media content from the web.

The remaining three vulnerabilities are use-after-free issues, a class of memory corruption bugs that occur when a program continues to use memory after it has been freed.

CVE-2026-16806 affects WebMCP, CVE-2026-16805 resides in the Blink rendering engine, and CVE-2026-16804 impacts Chrome’s input handling component. These flaws could allow attackers to manipulate browser behavior, trigger crashes, or potentially gain control of affected systems.

Use-after-free vulnerabilities are frequently targeted in real-world attacks because they can be reliably exploited in complex browser environments.

Emergency Chrome Update

In Chrome’s case, components like Blink and input processing are heavily exposed to web content, increasing the potential attack surface for malicious actors delivering crafted payloads through web pages.

Google noted that access to detailed bug reports and exploit information will remain restricted until a majority of users have updated their browsers. This is a standard industry practice aimed at reducing the risk of weaponization before patches are widely deployed.

The vulnerabilities were identified internally by Google, highlighting the company’s continued reliance on advanced security testing tools such as AddressSanitizer, MemorySanitizer, and libFuzzer.

These tools are designed to detect memory safety issues during development, helping prevent vulnerabilities from reaching production releases.

Although there is no confirmation of active exploitation in the wild at the time of disclosure, the high severity rating and the nature of the flaws make timely patching critical. Browsers remain a primary target for attackers due to their role as the main interface between users and web content.

Users and organizations are strongly advised to update Chrome immediately to mitigate potential risks. Most installations will receive the update automatically, but users can manually verify their version by navigating to the Chrome settings menu and checking for updates.

This release underscores the ongoing importance of rapid patch management in modern cybersecurity environments. As attackers continue to focus on browser-based exploitation techniques, even short delays in applying updates can increase exposure to threats.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Google Rolls Out Emergency Chrome Update for Four High-Severity Security Flaws appeared first on Cyber Security News.