Google has released Chrome 149, a security update closing 429 vulnerabilities, 22 of them rated critical, across the desktop, Android and iOS versions of a browser used by roughly 3.5 billion people. Among the fixes is a $209,000 payout to the researchers who found the flaws, a reminder that the hunt for weaknesses in the software we trust still depends on human patience and skill as much as on machines. The protection reaches each person's device in its own time, through a quiet restart that most will never think about.
Chrome 149 Patches 429 Security Flaws, Including 22 Critical, as Researchers Earn $209,000 in Bounties
429 flaws fixed, 22 of them critical, and $209,000 paid to the people who found them
Mark
Four hundred twenty-nine fixes in one release. Why does that number matter?
Mimi
It shows how much is being found and closed at once, and 22 of them are rated critical. Those span ANGLE, GPU, Network, Passwords and more.
Mark
And $209,000 in bounties?
Mimi
Mostly two payments: $97,000 for an ANGLE flaw from an anonymous researcher, and $43,000 for a Network bug.
Luke
Careful with that. The article gives those two amounts, but it doesn't say how the remaining roughly $69,000 was divided, or how many researchers were paid.
Mark
The writer says human hackers still matter even with AI around. Is that established?
Luke
It's his opinion. The piece says some researchers use AI and also build proofs of concept themselves, but it offers no data on how much AI contributed.
Mimi
What it does show is the payout size, and that the top reward went to a critical bug.
Mark
He also called iOS critical flaws rare.
Luke
That's his characterization. No figures back it up in the article.
Mark
So what should a reader do?
Mimi
Update. On mobile, update the app. On desktop, go to Help, About Google Chrome, then restart.
Luke
And expect a lag. Google's Srinivas Sista says it rolls out over days or weeks, so not everyone has it yet.
The Pulse
- Twenty-two critical flaws sit inside a browser that billions open every day, and each one was a door left ajar.
- The largest bounty, $97,000, went to an anonymous researcher who exposed an out-of-bounds memory flaw in the ANGLE graphics component.
- Critical bugs surfacing on iOS and in the Passwords component caught attention, since such flaws are rarely seen there.
- Google is pushing the fix out over days and weeks, and users can speed it along through Help, About Google Chrome, then restart to seal the gap.
Google has released Chrome 149, a security update closing 429 vulnerabilities, 22 of them rated critical, across the desktop, Android and iOS versions of a browser used by roughly 3.5 billion people. Among the fixes is a $209,000 payout to the researchers who found the flaws, a reminder that the hunt for weaknesses in the software we trust still depends on human patience and skill as much as on machines. The protection reaches each person's device in its own time, through a quiet restart that most will never think about.
Google has released Chrome 149, a sweeping security update that patches 429 vulnerabilities, 22 of them rated critical. The fixes reach desktop, Android and iOS, and touch a browser that Forbes estimates is used by around 3.5 billion people.
The release also carries a notable reward. Researchers who reported flaws in this version received $209,000 in bounties. Some now lean on AI to hunt for bugs, yet the writer argues that the payouts show skilled human researchers, with their experience and craft in building proof-of-concept demonstrations, remain central to the work.
The biggest single payment, $97,000, went to an anonymous researcher for a critical out-of-bounds flaw in ANGLE, a Chrome graphics component. A second researcher, credited only by identifier, earned $43,000 for a critical use-after-free bug in the Network component. The critical flaws, catalogued CVE-2026-10881 through CVE-2026-10902, span many components, including GPU, Ozone, Passwords and Chrome for iOS, the last two of which drew particular surprise because critical issues there are rare.
For users, the path to safety depends on the device. Android and iOS users update their apps. Desktop users can wait for the automatic rollout, which Google says will unfold over days or weeks, or act now by opening the three-dot menu, choosing Help and then About Google Chrome. After the download and installation finish, a restart applies the protection.
Google has released Chrome 149, an update that fixes 429 security vulnerabilities in the browser, 22 of them rated critical. The fixes cover desktop, Android and iOS versions, and Forbes puts the browser's user base at roughly 3.5 billion people.
The update also comes with a large payout. Researchers who reported flaws disclosed in this release received $209,000 in bounty payments. The article notes that some researchers use AI to help find bugs, but that they also rely on their own experience and technical skill to build proof-of-concept demonstrations. In the writer's view, the size of the payouts shows that human bug hunting is far from dead.
The largest single reward, $97,000, went to an anonymous researcher. It was for a critical out-of-bounds read and write flaw in ANGLE, a Chrome component. The second largest, $43,000, went to a researcher credited under the identifier c6eed09fc8b174b0f3eebedcceb1e792. That bounty was for a critical use-after-free flaw in Chrome's Network component.
The 22 critical flaws are catalogued as CVE-2026-10881 through CVE-2026-10902. ANGLE accounts for three of them: an out-of-bounds read and write, an out-of-bounds write, and an out-of-bounds read. The GPU component has two out-of-bounds writes and a stack buffer overflow. Use-after-free bugs make up much of the rest. They were found in Network, Chromecast, FileSystem, Cast Streaming, Cast, GFX and Printing. Chromoting has two, and Ozone has three. Chrome for iOS has two, and Passwords has two.
The Forbes writer singled out two groups. Critical vulnerabilities in Chrome on iOS surprised him, since he describes them as extremely rare. The two critical flaws in the Passwords component also stood out to him. He stresses that all of them are now fixed, or will be once each copy of Chrome is updated.
How you get the fix depends on your device. On Android and iOS, you update the app. Desktop users have two options. One is to wait for the update to arrive automatically. Google Chrome's Srinivas Sista says it is rolling out over the coming days and weeks, so some people may wait a while.
The other is to trigger it manually. Open the three-dot Chrome menu and choose Help, then About Google Chrome. The download and installation begin on their own. When they finish, Chrome prompts you to restart the browser, and the protection takes effect after that restart.
Notable Quotes
The update is rolling out over the coming days/weeks.— Srinivas Sista, Google Chrome
Want the full story?
Read the original at Forbes ↗
Technology