Chrome Security Update Fixes Out-of-bounds Write And Use-after-free Flaws

Google has released a new Chrome Stable channel update addressing multiple high-severity memory safety vulnerabilities, including out-of-bounds write and use-after-free flaws that could potentially lead to arbitrary code execution.

The latest update upgrades Chrome to version 150.0.7871.186/.187 for Windows and macOS, and 150.0.7871.186 for Linux. The rollout is gradual and expected to reach users over the coming days and weeks.

Chrome Security Update

The update resolves four security issues, all rated high severity, primarily involving memory corruption vulnerabilities across key Chrome components:

• CVE-2026-16807: Out-of-bounds write in Codecs, reported by Google on May 30, 2026. This flaw could allow attackers to write data outside allocated memory boundaries, potentially enabling remote code execution.
• CVE-2026-16806: Use-after-free in WebMCP, reported on June 10, 2026. Exploitation may occur when freed memory is accessed, leading to browser crashes or controlled memory manipulation.
• CVE-2026-16805: Use-after-free in Blink, reported on June 12, 2026. Blink, Chrome’s rendering engine, is a frequent target due to its role in processing web content.
• CVE-2026-16804: Use-after-free in Input, reported on June 16, 2026. This issue affects input handling mechanisms and may be exploitable through crafted user interactions.

Use-after-free vulnerabilities are particularly dangerous because they allow attackers to manipulate memory after it has been released, often resulting in reliable exploitation chains when combined with other bugs.

Although Google has not disclosed active exploitation in the wild, the nature of these vulnerabilities suggests a high risk in real-world attack scenarios.

Threat actors commonly leverage memory corruption flaws in browsers as initial access vectors, especially through malicious websites or drive-by downloads.

For example, an attacker could craft a malicious webpage that triggers a use-after-free condition in Blink, leading to heap corruption and eventual execution of arbitrary code within the browser context.

To reduce the risk of exploitation, Google has restricted detailed bug reports until a majority of users have applied the update, a standard practice to prevent weaponization.

Tips for Users

According to Google’s advisory, users and organizations are strongly advised to update Chrome immediately to the latest version. Enterprises should prioritize patch deployment across managed environments, particularly for systems exposed to untrusted web content.

Security teams should also monitor for anomalous browser behavior and consider endpoint detection rules targeting browser-based exploitation techniques aligned with MITRE ATT&CK tactics such as T1189 (Drive-by Compromise).

Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN. 

The post Chrome Security Update Fixes Out-of-Bounds Write and Use-After-Free Flaws appeared first on Cyber Security News.