{"id":13671,"date":"2026-06-17T10:04:05","date_gmt":"2026-06-17T10:04:05","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/06\/17\/critical-chrome-vulnerabilities-allow-attackers-to-execute-arbitrary-code-update-now\/"},"modified":"2026-06-17T10:04:05","modified_gmt":"2026-06-17T10:04:05","slug":"critical-chrome-vulnerabilities-allow-attackers-to-execute-arbitrary-code-update-now","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/06\/17\/critical-chrome-vulnerabilities-allow-attackers-to-execute-arbitrary-code-update-now\/","title":{"rendered":"Critical Chrome Vulnerabilities Allow Attackers to Execute Arbitrary Code \u2013 Update Now!"},"content":{"rendered":"

Critical Chrome Vulnerabilities Allow Attackers to Execute Arbitrary Code \u2013 Update Now!
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Google has released a critical security update for its Chrome browser, addressing multiple high-severity vulnerabilities<\/a> that could allow attackers to execute arbitrary code on affected systems.<\/p>\n

Users are strongly advised to update immediately as several flaws impact core browser components.<\/p>\n

The latest Chrome Stable channel has been updated to version 149.0.7827.155\/.156 for Windows and macOS, and 149.0.7827.155 for Linux.<\/p>\n

The rollout is gradual and will reach users over the coming days and weeks. This release includes 33 security fixes<\/a>, several of which are rated critical due to their potential for remote code execution (RCE).<\/p>\n

Google has restricted detailed technical information for some bugs until the majority of users have installed the update.<\/p>\n

\nChrome<\/strong> Vulnerabilities Enable Code Execution<\/strong>
\n<\/h2>\n

Among the patched issues, seven critical vulnerabilities stand out, primarily involving \u201cuse-after-free\u201d memory corruption bugs. These flaws can allow attackers to manipulate memory and execute arbitrary code <\/a>within the browser context.<\/p>\n

Key critical vulnerabilities include:<\/p>\n

CVE-2026-12437:<\/strong> Use-after-free in WebShare.<\/p>\n

CVE-2026-12438: <\/strong>Inappropriate implementation in WebView.<\/p>\n

CVE-2026-12439 & CVE-2026-12440:<\/strong> Use-after-free in Digital Credentials.<\/p>\n

CVE-2026-12441:<\/strong> Use-after-free in File Input.<\/p>\n

CVE-2026-12442:<\/strong> Use-after-free in Passwords.<\/p>\n

CVE-2026-12443:<\/strong> Use-after-free in Web Authentication.<\/p>\n

Use-after-free vulnerabilities occur when memory is accessed after it has been released, potentially allowing attackers to corrupt memory structures and gain control of the execution flow.<\/p>\n

In a real-world scenario, a victim simply visiting a malicious webpage could trigger exploitation<\/a> without additional interaction. In addition to critical flaws, Google patched numerous high-severity vulnerabilities across components such as WebRTC, Extensions, Safe Browsing, GPU, and File System Access.<\/p>\n

Other Notable Vulnerabilities<\/strong><\/h2>\n

Heap buffer overflows in WebRTC (CVE-2026-12447, CVE-2026-1246. Out-of-bounds reads in Chromoting and WebRTC.<\/p>\n

Multiple use-after-free flaws in Extensions<\/a>, Media, Downloads, and Browser. Insufficient validation and policy enforcement issues across input handling and extensions.<\/p>\n

These vulnerabilities could lead to data leaks, sandbox escapes, or further exploitation chains when combined with other bugs.<\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CVE ID<\/th>\nSeverity<\/th>\nComponent<\/th>\nVulnerability type<\/th>\nReporter<\/th>\nReported date<\/th>\n<\/tr>\n<\/thead>\n
CVE-2026-12437<\/td>\nCritical<\/td>\nWebShare<\/td>\nUse after free<\/td>\nGoogle<\/td>\n2026-05-25<\/td>\n<\/tr>\n
CVE-2026-12438<\/td>\nCritical<\/td>\nWebView<\/td>\nInappropriate implementation<\/td>\nGoogle<\/td>\n2026-05-27<\/td>\n<\/tr>\n
CVE-2026-12439<\/td>\nCritical<\/td>\nDigital Credentials<\/td>\nUse after free<\/td>\nGoogle<\/td>\n2026-06-03<\/td>\n<\/tr>\n
CVE-2026-12440<\/td>\nCritical<\/td>\nDigitalCredentials<\/td>\nUse after free<\/td>\nGoogle<\/td>\n2026-06-03<\/td>\n<\/tr>\n
CVE-2026-12441<\/td>\nCritical<\/td>\nFile Input<\/td>\nUse after free<\/td>\nGoogle<\/td>\n2026-06-05<\/td>\n<\/tr>\n
CVE-2026-12442<\/td>\nCritical<\/td>\nPasswords<\/td>\nUse after free<\/td>\nGoogle<\/td>\n2026-06-09<\/td>\n<\/tr>\n
CVE-2026-12443<\/td>\nCritical<\/td>\nWeb Authentication<\/td>\nUse after free<\/td>\nGoogle<\/td>\n2026-06-11<\/td>\n<\/tr>\n
CVE-2026-12444<\/td>\nHigh<\/td>\nChromoting<\/td>\nOut of bounds read<\/td>\nGoogle<\/td>\n2026-05-14<\/td>\n<\/tr>\n
CVE-2026-12445<\/td>\nHigh<\/td>\nExtensions<\/td>\nUse after free<\/td>\nGoogle<\/td>\n2026-05-14<\/td>\n<\/tr>\n
CVE-2026-12446<\/td>\nHigh<\/td>\nPasswords<\/td>\nInsufficient data validation<\/td>\nGoogle<\/td>\n2026-05-14<\/td>\n<\/tr>\n
CVE-2026-12447<\/td>\nHigh<\/td>\nWebRTC<\/td>\nHeap buffer overflow<\/td>\nGoogle<\/td>\n2026-05-15<\/td>\n<\/tr>\n
CVE-2026-12448<\/td>\nHigh<\/td>\nWebView<\/td>\nInappropriate implementation<\/td>\nGoogle<\/td>\n2026-05-15<\/td>\n<\/tr>\n
CVE-2026-12449<\/td>\nHigh<\/td>\nChromoting<\/td>\nUse after free<\/td>\nGoogle<\/td>\n2026-05-15<\/td>\n<\/tr>\n
CVE-2026-12450<\/td>\nHigh<\/td>\nMedia<\/td>\nInappropriate implementation<\/td>\nZhixin Tu<\/td>\n2026-05-19<\/td>\n<\/tr>\n
CVE-2026-12451<\/td>\nHigh<\/td>\nDigitalCredentials<\/td>\nUse after free<\/td>\nGoogle<\/td>\n2026-05-19<\/td>\n<\/tr>\n
CVE-2026-12452<\/td>\nHigh<\/td>\nDownloads<\/td>\nUse after free<\/td>\nGoogle<\/td>\n2026-05-21<\/td>\n<\/tr>\n
CVE-2026-12453<\/td>\nHigh<\/td>\nInput<\/td>\nInsufficient validation of untrusted input<\/td>\nGoogle<\/td>\n2026-05-25<\/td>\n<\/tr>\n
CVE-2026-12454<\/td>\nHigh<\/td>\nSafe Browsing<\/td>\nRace condition<\/td>\nGoogle<\/td>\n2026-05-27<\/td>\n<\/tr>\n
CVE-2026-12455<\/td>\nHigh<\/td>\nTab Strip<\/td>\nUse after free<\/td>\nGoogle<\/td>\n2026-05-27<\/td>\n<\/tr>\n
CVE-2026-12456<\/td>\nHigh<\/td>\nExtensions<\/td>\nInsufficient validation of untrusted input<\/td>\nGoogle<\/td>\n2026-05-27<\/td>\n<\/tr>\n
CVE-2026-12457<\/td>\nHigh<\/td>\nExtensions<\/td>\nInsufficient data validation<\/td>\nGoogle<\/td>\n2026-05-27<\/td>\n<\/tr>\n
CVE-2026-12458<\/td>\nHigh<\/td>\nPasswords<\/td>\nIncorrect security UI<\/td>\nGoogle<\/td>\n2026-05-27<\/td>\n<\/tr>\n
CVE-2026-12459<\/td>\nHigh<\/td>\nSerial<\/td>\nInappropriate implementation<\/td>\nGoogle<\/td>\n2026-05-28<\/td>\n<\/tr>\n
CVE-2026-12460<\/td>\nHigh<\/td>\nFile System Access<\/td>\nInsufficient policy enforcement<\/td>\nGoogle<\/td>\n2026-05-28<\/td>\n<\/tr>\n
CVE-2026-12461<\/td>\nHigh<\/td>\nWebRTC<\/td>\nOut of bounds read<\/td>\nGoogle<\/td>\n2026-05-29<\/td>\n<\/tr>\n
CVE-2026-12462<\/td>\nHigh<\/td>\nMedia<\/td>\nUse after free<\/td>\nGoogle<\/td>\n2026-05-29<\/td>\n<\/tr>\n
CVE-2026-12463<\/td>\nHigh<\/td>\nViews<\/td>\nInappropriate implementation<\/td>\nGoogle<\/td>\n2026-05-30<\/td>\n<\/tr>\n
CVE-2026-12464<\/td>\nHigh<\/td>\nBrowser<\/td>\nUse after free<\/td>\nGoogle<\/td>\n2026-06-03<\/td>\n<\/tr>\n
CVE-2026-12465<\/td>\nHigh<\/td>\nMetrics<\/td>\nInsufficient validation of untrusted input<\/td>\nGoogle<\/td>\n2026-06-05<\/td>\n<\/tr>\n
CVE-2026-12466<\/td>\nHigh<\/td>\nWebRTC<\/td>\nHeap buffer overflow<\/td>\nGoogle<\/td>\n2026-06-05<\/td>\n<\/tr>\n
CVE-2026-12467<\/td>\nHigh<\/td>\nExtensions<\/td>\nUse after free<\/td>\nGoogle<\/td>\n2026-06-05<\/td>\n<\/tr>\n
CVE-2026-12468<\/td>\nHigh<\/td>\nUpdater<\/td>\nInappropriate implementation<\/td>\nGoogle<\/td>\n2026-06-08<\/td>\n<\/tr>\n
CVE-2026-12469<\/td>\nHigh<\/td>\nGPU<\/td>\nUninitialized use<\/td>\nGoogle<\/td>\n2026-06-09<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Google credits its internal security tools for identifying many of these vulnerabilities, including AddressSanitizer, MemorySanitizer, libFuzzer, and Control Flow Integrity mechanisms.<\/p>\n

These tools play a key role in proactively identifying memory safety issues before they are exploited in the wild.<\/p>\n

Users and organizations should take immediate action: Update Chrome to the latest version via Settings > About Chrome. Restart the browser to ensure patches are applied.<\/p>\n

Monitor enterprise environments for outdated browser versions. Apply defense-in-depth strategies such as endpoint protection and browser isolation.<\/p>\n

Given the number of critical memory corruption vulnerabilities, delaying updates significantly increases the risk of exploitation.<\/p>\n

CISO & Security Leaders: Your next breach may not have a face. Join ISC2\u2019s LIVE webinar, \u201cGhost in the Machine\u201d<\/strong><\/a><\/p>\n

The post Critical Chrome Vulnerabilities Allow Attackers to Execute Arbitrary Code \u2013 Update Now!<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Abinaya
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Critical Chrome Vulnerabilities Allow Attackers to Execute Arbitrary Code \u2013 Update Now! Google has released a critical security update for its Chrome browser, addressing multiple high-severity vulnerabilities that could allow attackers to execute arbitrary code on affected systems. Users are strongly advised to update immediately as several flaws impact core browser components. The latest Chrome […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[768,129,63,648],"tags":[130],"class_list":["post-13671","post","type-post","status-publish","format-standard","hentry","category-chrome","category-cyber-security","category-cyber-security-news","category-vulnerability-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13671"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=13671"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13671\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=13671"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=13671"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=13671"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}