Google Chrome Security Update Patches 27 Vulnerabilities and Two Dangerous Code Execution Bugs

Summarize this blog post with:
ChatGPT | Perplexity | Claude | Grok

You've probably clicked "Relaunch" on a Chrome update notification more times than you can count without giving it a second thought. What most users don't realize is that this week's update closes two critical memory-corruption bugs that could let an attacker run code on your machine just by getting you to load a malicious webpage. In this guide, you'll learn exactly what Google fixed, which components were affected, and how to confirm you're protected.

Key Takeaways

• ▸Google shipped a new Chrome Stable update fixing 27 security vulnerabilities, bringing the browser to version 150.0.7871.114/.115 on Windows and macOS, and 150.0.7871.114 on Linux.
• ▸Two critical-severity use-after-free bugs — CVE-2026-15112 (Ozone) and CVE-2026-15129 (Views) — could allow remote code execution if exploited.
• ▸CVE-2026-15132, an uninitialized-use flaw in Chrome's V8 JavaScript engine, was also patched in this release.
• ▸Google says none of the 27 vulnerabilities show evidence of active exploitation in the wild, unlike several Chrome zero-days patched earlier this year.
• ▸Of the 27 fixes, 24 were discovered internally by Google's own security team, with the remainder reported by external researchers who received a combined $3,000 in bounty payouts.
• ▸Use-after-free vulnerabilities remain the single most common bug class in this release, accounting for 13 of the 27 fixes.
• ▸Since April 2026, Google has resolved more than 1,400 Chrome vulnerabilities, reflecting the scale of ongoing security work on the browser.

What Is the Latest Chrome Security Update?

The latest Chrome security update is a Stable channel release that fixes 27 vulnerabilities, including two rated Critical, bringing Chrome to version 150.0.7871.114/.115 on Windows and macOS and 150.0.7871.114 on Linux. The update began rolling out on July 8, 2026, and will reach users gradually over the coming days and weeks, which is standard practice for Chrome to avoid overwhelming update infrastructure all at once. Android and iOS versions of Chrome received similar security patches around the same time.

Of the 27 vulnerabilities patched, 23 are rated High severity and two are rated Medium, alongside the two Critical bugs. For example, Google's own security engineers discovered 24 of the 27 issues through internal testing and fuzzing, while independent researchers reported the rest and received a combined $3,000 in bug bounty rewards. This split matters because it shows Google's internal security research is catching the majority of serious flaws before external researchers or attackers do.

Why Does This Chrome Update Matter?

This update matters because two of the patched bugs are Critical-severity flaws capable of remote code execution, meaning an attacker could potentially run their own code on a victim's machine simply by getting them to visit a crafted webpage. Chrome remains the most widely used desktop browser globally, which makes it a persistent, high-value target for exploit developers regardless of how quickly Google patches individual bugs.

At the same time, context matters here: Google states that none of the 27 vulnerabilities in this release show evidence of active exploitation, unlike several Chrome zero-days patched earlier in 2026, including a V8 out-of-bounds flaw exploited in the wild before its fix shipped. This means the current update is squarely in "patch before attackers catch up" territory rather than an active-exploitation emergency. That said, use-after-free bugs are historically among the most frequently weaponized vulnerability classes in browser security, so the absence of confirmed exploitation today doesn't guarantee that stays true for long.

Technical Breakdown: What Were the Critical Bugs?

Both critical vulnerabilities in this release are use-after-free (UAF) bugs, a memory-corruption flaw class that occurs when a program continues referencing memory after it has already been freed. When this happens, an attacker who can control what gets placed in that freed memory location may be able to hijack the program's execution flow entirely.

CVE-2026-15112 — Use-After-Free in Ozone

For example, CVE-2026-15112 affects Ozone, Chrome's platform abstraction layer responsible for handling graphics and windowing across different operating systems. Google's own security team discovered this flaw internally on May 29, 2026, ahead of this week's fix. Because Ozone sits close to how Chrome renders content to the screen, a successful exploit here could give an attacker a foothold deep inside the browser's rendering pipeline.

CVE-2026-15129 — Use-After-Free in Views

The second critical flaw, CVE-2026-15129, resides in Views, the UI framework component Chrome uses for its interface elements, and was discovered internally on June 15, 2026. This can allow arbitrary code execution within the browser's process if an attacker successfully triggers the flaw, which is why Google assigned it the same Critical rating as the Ozone bug.

CVE-2026-15132 — Uninitialized Use in V8

Beyond the two Critical bugs, CVE-2026-15132 patches an uninitialized-use vulnerability in V8, Chrome's JavaScript engine. V8 processes nearly all the dynamic code running on modern websites, which makes it a frequent target for exploit developers precisely because of its complexity and constant exposure to untrusted web content. A separate fix, CVE-2026-15108, addressed an integer overflow in Chrome's Extensions API that could let a malicious or crafted extension compromise browser integrity.

Lower-Severity Fixes Worth Knowing About

Several additional patched flaws stemmed from insufficient validation of untrusted input in components like WebAppInstalls and Codecs, alongside fixes to password management, navigation handling, and DOM validation logic. These lower-severity issues don't directly enable code execution on their own, but they can still weaken browser security guarantees or be chained together with other bugs in a more complex exploit.

Is the Chrome Vulnerability Being Actively Exploited?

No — Google has stated that none of the vulnerabilities fixed in this release show evidence of active exploitation at the time of disclosure. That's a meaningfully different risk profile than several earlier 2026 Chrome patches, including a V8 out-of-bounds read-and-write flaw that Google confirmed was already being used in the wild before a fix was available. Even so, the presence of confirmed exploit code in past Chrome UAF bugs is exactly why Google and independent researchers treat this bug class as a standing priority regardless of confirmed exploitation status on any given day.

How Do You Update Chrome to the Latest Secure Version?

Updating Chrome takes less than a minute, and the fix only takes effect once you restart the browser.

Click the three-dot menu in the top-right corner of Chrome.

Navigate to Help → About Google Chrome.

Chrome will automatically check for updates and begin downloading version 150.0.7871.114/.115.

Click Relaunch once the download finishes — the patch isn't active until the browser restarts.

Confirm the version number shown reads 150.0.7871.114 or higher (150.0.7871.115 on some Windows/Mac builds).

[Insert image: Screenshot of the About Google Chrome settings page showing the version check | Alt text: "Verify Chrome version after July 2026 security update"]

If your organization manages Chrome through Group Policy, confirm automatic updates haven't been suppressed, since delayed enterprise rollout is one of the most common reasons a fleet stays exposed longer than necessary after a patch ships.

How Should Enterprises Manage This Update?

Enterprises should treat critical Chrome patches with the same urgency as operating system security updates, given how deeply integrated the browser is into daily workflows across nearly every device type.

• ▸Confirm Chrome's auto-update policy is enabled in your endpoint management console rather than relying on individual users to update manually.
• ▸Prioritize devices with high web-browsing exposure — customer-facing support desks, shared kiosks, and executive devices — for immediate patch verification.
• ▸Audit installed extensions given the Extensions API integer overflow fixed in this release, since a compromised or malicious extension could exploit similar logic flaws.
• ▸Track Chrome's release notes for future updates, since Google has patched more than 1,400 Chrome vulnerabilities since April 2026 alone, a pace that shows no signs of slowing.

Security teams verifying browser exposure across their fleet can pair this patch cycle with a website vulnerability scanner to confirm no internet-facing services are still serving outdated, unpatched browser components to end users.

Practical Security Best Practices

• ▸Enable automatic updates on every managed and personal device so critical patches land without waiting on manual action.
• ▸Restart your browser promptly after an update downloads — Chrome's fix isn't active until you relaunch, a step many users skip for days.
• ▸Avoid unfamiliar or unsolicited links, since remote code execution bugs like these are typically triggered simply by loading a crafted webpage.
• ▸Review browser extensions regularly and remove anything with excessive permissions or an unclear publisher.
• ▸Monitor Chrome's security release notes directly rather than relying solely on secondhand reporting for the latest patch status.

Before trusting an unfamiliar link, an SSL certificate checker can confirm a site's certificate hasn't been spoofed, and a WHOIS domain lookup helps verify how long a domain has actually existed before you click through.

What's Next? Staying Ahead of Future Chrome CVEs

Chrome's security team ships patches on a near-constant cadence, and this release is unlikely to be the last critical fix of the year.

• ▸Subscribe to the official Chrome Releases blog so new security updates reach you the day they're published.
• ▸Track related Chromium-based browser advisories, since Microsoft Edge shares the same rendering engine — our recent coverage of the critical Edge remote code execution vulnerability walks through a comparable class of memory-corruption bug.
• ▸Build browser patching into your regular vulnerability management cadence rather than treating it as a background, low-priority task.
• ▸Review our full cybersecurity news hub for ongoing coverage of newly disclosed CVEs affecting browsers and everyday software.

Conclusion

This Chrome update is a reminder that even a browser as heavily scrutinized as Chrome continues to carry memory-unsafe code capable of full remote code execution. The good news is that Google caught the majority of these bugs internally before attackers found them, and there's no evidence of exploitation in this batch. The only irresponsible move at this point is delay — confirm your version reads 150.0.7871.114 or higher, restart your browser, and keep automatic updates enabled going forward. Stay subscribed to trusted browser security advisories so the next critical Chrome patch reaches you before an attacker does.

Written by ReconShield Editorial Team — a cybersecurity publication covering cyber threats, data breaches, vulnerabilities, malware, threat intelligence, and online privacy, providing practical insights to help readers stay informed and secure.

Reviewed by Surendra Reddy, Founder & Principal Security Engineer, ReconShield — a cybersecurity researcher specializing in OSINT, infrastructure exposure intelligence, and passive diagnostic tooling.

Read More:

AI Bug Hunting: How Security Researchers Use AI to Find Vulnerabilities in

CVE-2026-46331: New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries

Update Chrome Now: 382 Security Vulnerabilities Patched, Including 15 Critical Bugs

Security Alert: Multiple FatFs Vulnerabilities Impact Embedded Devices Worldwide

Top 15 Critical CVE-2026 Vulnerabilities Every IT Team Should Know

Breaking: Hackers Claim Massive Accenture Data Breach, 35GB of Source Code Allegedly Stolen