Chrome 150 Security Update Fixes 15 Flaws, Including Two Critical Use-After-Free Bugs

TL;DR

Google has shipped a Chrome security update that raises the Stable channel to 150.0.7871.124/.125 on Windows and Mac, and 150.0.7871.124 on Linux. The release fixes 15 security flaws, including two critical use-after-free bugs in Ozone, CVE-2026-15764 and CVE-2026-15765. Google has not reported in-the-wild exploitation or public proof-of-concept code for any of these flaws.

Why It Matters

Chrome dominates the desktop browser market, so browser flaws reach a huge install base. Critical use-after-free bugs often serve as the entry point for sandbox escapes and code execution. For that reason, Google keeps bug details restricted until most users receive the fix. Attackers routinely diff Chromium patches, which shrinks the safe patching window.

How the Attacks Work

The two critical bugs corrupt memory through use-after-free conditions in Ozone, Chrome’s platform abstraction layer. Eleven high-severity flaws follow, spread across V8, Skia, GPU, Core, UI, Media, and libyuv. They include type confusion in V8 (CVE-2026-15776), a heap buffer overflow in libyuv (CVE-2026-15767), and several uninitialized-use and policy-enforcement issues. A medium-severity input validation flaw in Navigation rounds out the list.

Notable CVEs

Affected Versions

All Chrome desktop builds before 150.0.7871.124 on Windows, Mac, and Linux carry these flaws. Chromium-based browsers, such as Edge, typically inherit the same fixes in later updates.

Patch and Mitigation Steps

Open Settings, then Help, then About Google Chrome to trigger the update, and relaunch the browser. Enterprises should push the Chrome security update through managed channels without delay.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.