Do Son 
TL;DR
Google pushed Chrome 150.0.7871.186/.187 to the Stable channel on 23 July 2026. This Chrome security update closes four high-severity memory bugs, all found by Google’s own teams. One is a Codecs flaw that published CVE records tie to a possible sandbox escape.
- Product: Google Chrome
- Vulnerabilities: 4 flaws (CVE-2026-16807, CVE-2026-16806, CVE-2026-16805, CVE-2026-16804)
- Highest severity: Awaiting analysis
- Worst impact: Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker...
- Status: No confirmed exploitation yet; patches available
- Action: Update to 150.0.7871.186 now
| CVE | CVSS | Type | Status |
|---|
Why it matters
Every bug in this batch rates High. Three are use-after-free issues, and one is an out-of-bounds write. Memory-safety bugs in a browser sit on the front line, because any web page can reach the affected code.
CVE-2026-16807 stands out. CVE records describe it as an out-of-bounds write in Codecs that could let a remote attacker attempt a sandbox escape through a crafted HTML page. Sandbox escapes matter, since they move an attacker out of the tab and toward the host.
How the attacks work
The mechanism is memory corruption rather than a logic flaw. A use-after-free happens when code touches memory it has already released. An attacker who can reclaim that memory may then steer execution.
CVE-2026-16806 affects WebMCP. Its CVE record points to arbitrary code execution inside the sandbox via a crafted page. The other two, CVE-2026-16805 in Blink and CVE-2026-16804 in Input, are also use-after-free bugs. Google has published no further impact detail for that pair.
Exploitation status
Google reports no exploitation in the wild. No public proof-of-concept exists either. Google found all four internally between 30 May and 16 June 2026, and no external bounty appears in the advisory. Bug tracker details stay restricted until most users have updated.
Affected versions and patching
Builds before 150.0.7871.186 are affected. Windows and Mac users need 150.0.7871.186 or .187, while Linux users need .186. Open Chrome’s About page to force the check, then relaunch the browser.
The rollout runs over days or weeks, so managed fleets should not wait for automatic delivery. Chromium-based browsers such as Edge, Brave, and Opera inherit these fixes on their own schedules.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
