Chrome Update Fixes 5 Use-After-Free Security Bugs

TL;DR

Google shipped a new Chrome security update on the Stable channel. It fixes five high-severity use-after-free flaws across V8, Blink, HTML, TabStrip, and Extensions. No exploitation in the wild has been confirmed, but you should update now.

Notable CVEs

Why it matters

Chrome runs on billions of devices, so any memory bug has a wide blast radius. This Chrome security update closes five separate use-after-free holes. Each one lets a crafted web page corrupt memory in the browser.

According to the MITRE records, four of these bugs allow remote code execution inside the sandbox. A booby-trapped HTML page is enough to trigger them. Therefore, prompt patching matters even without active attacks.

How the attack works

A use-after-free flaw happens when code touches memory that was already released. Attackers can shape that freed memory with their own data. As a result, they may crash the renderer or run code.

All five bugs sit in components that handle untrusted web content. The affected areas are V8, TabStrip, Extensions, HTML, and Blink. Google has withheld deeper bug details until most users update.

The five flaws

Google credits external researchers and its own team for the reports. The tracked issues are CVE-2026-19556 in V8, CVE-2026-19557 in TabStrip, and CVE-2026-19558 in Extensions. Two more, CVE-2026-19559 in HTML and CVE-2026-19560 in Blink, round out the list.

Affected versions

The flaws affect Chrome builds before 151.0.7922.137. Google fixed them in 151.0.7922.137/.138 for Windows and Mac. Linux users get 151.0.7922.137.

Patch and mitigation steps

Chrome usually updates on its own. Still, you can force it fast. Open the menu, then Help, then About Google Chrome.

The browser checks for the update and prompts a restart. Restart to apply this Chrome security update. Enterprise admins should push the fixed build across managed fleets.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.