cyber.hendryadrian.com
Security News · securityweek.com

Chrome 149 Update Patches Record 429 Vulnerabilities

· Original article ↗

Summary

Google released Chrome 149 with patches for 429 vulnerabilities, including more than 100 critical- and high-severity flaws. One ANGLE vulnerability could let remote attackers escape the browser sandbox using a crafted HTML page.

Key points

  • Chrome 149 is rolling out as version 149.0.7827.53 on Linux and 149.0.7827.53/54 on Windows and macOS.
  • The release fixes 429 vulnerabilities, a record for a single Chrome update; more than 100 are rated critical or high severity.
  • CVE-2026-10881, an out-of-bounds read and write flaw in ANGLE, could allow remote attackers to escape Chrome’s sandbox through a crafted HTML page and potentially execute code on the operating system.
  • Other critical flaws include CVE-2026-10882, a use-after-free issue in Network, and CVE-2026-10883, an out-of-bounds write in ANGLE.
  • Many patched flaws involve use-after-free and insufficient validation of untrusted input.

Article Details

Event Type
Chrome security update addressing 429 vulnerabilities
Impact
Chrome 149 patches 429 vulnerabilities, including more than 100 critical- and high-severity issues. The most severe, CVE-2026-10881, could allow remote attackers to escape Chrome’s sandbox and potentially execute code on the underlying operating system through a crafted HTML page. The update is rolling out as version 149.0.7827.53 for Linux and versions 149.0.7827.53/54 for Windows and macOS.

CVE

CVE-2026-10881Google · ChromeThe most severe of the bugs is CVE-2026-10881 (CVSS score of 9.6), an out-of-bounds read and write weakness in the ANGLE graphics engine.CVE-2026-10882Google · ChromeTwo other critical-severity defects were reported by external researchers, namely CVE-2026-10882, a use-after-free issue in Network, which earned the reporting researcher a $43,000 reward, and CVE-2026-10883, anCVE-2026-10883Google · Chromea use-after-free issue in Network, which earned the reporting researcher a $43,000 reward, and CVE-2026-10883, an out-of-bounds write in ANGLE that was awarded a $5,000 bug bounty.

Vendors

GoogleGoogle this week promoted Chrome 149 to the stable channel with patches for 429 vulnerabilities, a record for a single Chrome refresh.

Products

ANGLEThe most severe of the bugs is CVE-2026-10881 (CVSS score of 9.6), an out-of-bounds read and write weakness in the ANGLE graphics engine.Google ChromeGoogle this week promoted Chrome 149 to the stable channel with patches for 429 vulnerabilities, a record for a single Chrome refresh.

Related Articles