Google has released Chrome 149, a routine but weighty turn in the long effort to keep the browser that most of the world uses for daily life from becoming a door for those who would misuse it. Eighteen security flaws were closed in this update, ten of them memory errors of a kind that can hand control of a machine to a stranger or quietly drain its data. Google has chosen to say little about how each flaw works, leaving the details sealed until enough people have installed the fix, a familiar patience between the makers of software and those who would exploit it. The update is now spreading ac
Google Patches 18 Chrome Vulnerabilities in Chrome 149, Including Three Critical Use-After-Free Flaws
Google does not say any of the fixed flaws have been used in attacks, yet.
Mark
Eighteen fixes sounds like a lot, but the piece says it's actually a light release. Why?
Mimi
Because of the recent past. Google patched a significant number of bugs in April and May, and 429 patches arrived at the start of June. Eighteen is small beside that.
Mark
Ten of the eighteen are use-after-free. Why does that category matter?
Mimi
It's a memory flaw where a program touches memory it already released. Attackers can use that to take control, steal data or crash a system.
Luke
Worth noting that's the general risk of the bug class. Google hasn't said any of these 18 were exploited.
Mark
So why update at all?
Mimi
Because details are deliberately sparse now, and once they come out, attackers can study them. Rollout takes days or weeks, so manually updating closes the gap.
Luke
One caution on the numbers. The report lists CVE-2026-13028 twice for the two Web Graphics Library bugs. That looks like a duplicate, so I wouldn't treat the identifiers as settled.
Mark
Which ones are critical?
Mimi
Three use-after-free bugs, two in Web Graphics Library and one in Autofill, plus an out-of-bounds read in Blink InterestGroups.
Luke
And we don't know how they could be chained or exploited. Google isn't saying, and the reporting can't fill that in.
Le Pouls
- Three critical memory flaws sit at the heart of this release, touching graphics, autofill and the engine's interest-group component, the sort of openings attackers hunt first.
- Google is withholding technical detail on purpose, so the window between disclosure and mass patching stays as narrow as possible.
- The rollout is staged, meaning many machines will remain exposed for days or weeks while the fix creeps outward through the user base.
- Eighteen fixes is a far calmer tally than the 429 patches issued in June, yet the urgency of getting the update installed has not eased.
Google has released Chrome 149, a routine but weighty turn in the long effort to keep the browser that most of the world uses for daily life from becoming a door for those who would misuse it. Eighteen security flaws were closed in this update, ten of them memory errors of a kind that can hand control of a machine to a stranger or quietly drain its data. Google has chosen to say little about how each flaw works, leaving the details sealed until enough people have installed the fix, a familiar patience between the makers of software and those who would exploit it. The update is now spreading across Windows, Mac and Linux machines over the coming days and weeks, and no attacks using these particular flaws have been reported so far.
Google has pushed out Chrome 149, a security update for its widely used browser that closes 18 vulnerabilities, several of them serious. The Stable channel now carries version 149.0.7827.196 or 197 on Windows and Mac and 149.0.7827.196 on Linux, and the update will reach people gradually over the coming days and weeks.
Google has said very little about what each fix addresses, a deliberate silence meant to give users time to update before attackers can study the details. What it does reveal is that ten of the 18 bugs are use-after-free flaws, a kind of memory error in which a program reaches for memory it has already released. In the wrong hands, such a flaw can let someone seize control of a machine, steal information, or crash it.
Three of these flaws are rated critical. Two sit in the Web Graphics Library, the browser interface that draws interactive graphics, and one, found by Google's own researchers, affects Autofill. A critical out-of-bounds read in the InterestGroups component is also closed. The remaining high-impact fixes cover Bluetooth, Passwords, and two further implementation issues.
The count is modest compared with recent months, when Google found a great many more problems and issued 429 patches at the start of June. Google will keep bug details and links restricted until most users have the fix, and longer still if a flaw lives in a shared third-party library that others have not yet patched.
Google has not reported that any of these flaws have been exploited. Still, the advice from those who follow such matters is not to wait for the staged rollout. If Chrome has not yet offered the update, checking for it manually is the safer path.
Google has pushed out Chrome 149, an update to its widely used browser that fixes 18 security vulnerabilities, many of them serious. The Stable channel is now at version 149.0.7827.196/197 for Windows and Mac and 149.0.7827.196 for Linux, and the rollout will reach users over the coming days and weeks.
Google says little about what each fix actually does, a deliberate choice meant to give people time to update before attackers can study the details. What it does disclose is that 10 of the 18 bugs are use-after-free flaws. This is a class of memory corruption problem in which a program tries to reach memory that has already been released. Exploited, such a flaw can let an attacker take control of a system, steal data, or crash it.
Three of the use-after-free bugs are rated critical. Two of them sit in the Web Graphics Library, the JavaScript API that draws interactive 2D and 3D graphics inside a browser. The source lists both under the same identifier, CVE-2026-13028, which appears to be a repeat in the reporting rather than two distinct numbers. The third critical use-after-free, tracked as CVE-2026-13038, was found by Google researchers and affects Chrome's Autofill feature.
Google also fixed a critical out-of-bounds read in Blink's InterestGroups component, tracked as CVE-2026-13033. Beyond the critical group, the update addresses CVE-2026-13035, a use-after-free in Bluetooth rated high impact. CVE-2026-13034 is an inappropriate implementation issue in Passwords, reported by Google and also rated high. Two further inappropriate implementation flaws received high ratings as well.
The total is modest against recent history. In April and May Google found a significant number of vulnerabilities, and 429 patches were issued at the start of June. Eighteen is far below that.
Google has said it may keep access to bug details and links restricted until a majority of users have the fix. It will also hold the restrictions if a bug lives in a third-party library that other projects depend on and have not yet patched.
Google does not say that any of the flaws fixed in Chrome 149 have been used in attacks. Forbes contributor Davey Winder has written about how to update manually, and the advice is not to wait for the staged rollout. If Chrome hasn't offered the update to you yet, checking for it yourself is the safer course.
Citations marquantes
Google may restrict bug details until most users are updated, and keep restrictions if the bug is in a third-party library other projects depend on and haven't fixed.— Google, Chrome blog (paraphrased)
Envie de l'histoire complète ?
Lire l'original sur Forbes ↗
Technology