Google Chrome 149 Multiple Memory-Corruption Vulnerabilities Enable Arbitrary Code Execution (CVE-2026-12437 through CVE-2026-12469)

Google Chrome 149 Multiple Memory-Corruption Vulnerabilities (TL-2026-0886), also tracked as Chrome 149 June 2026 Stable Channel Update, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-06-20. It has no confirmed attribution, affects Google Chrome (Desktop, Windows), references 25 CVEs (CVE-2026-12437, CVE-2026-12438, CVE-2026-12439), maps to 15 MITRE ATT&CK techniques (T1005, T1036, T1041), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-0886

Threat ID
TL-2026-0886
Also known as
Chrome 149 June 2026 Stable Channel Update, Chrome 149.0.7827.155 security update
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-06-20
Last reviewed
2026-06-20
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
all sectors, government, financial, healthcare, technology, education
Target regions
Global
Detection rules
9
Indicators of compromise
18

Google shipped Chrome Stable 149.0.7827.155/.156 (Windows/macOS) and 149.0.7827.155 (Linux) on 2026-06-17 with 33 security fixes, including 7 Critical use-after-free / inappropriate-implementation flaws in WebShare, WebView, Digital Credentials, File Input, Passwords, and Web Authentication, plus 26 High-severity memory-corruption bugs. A victim simply visiting a malicious webpage could trigger exploitation leading to arbitrary code execution in the renderer. No in-the-wild exploitation is confirmed in the sources.

How Google Chrome 149 Multiple Memory-Corruption Vulnerabilities works

On June 17, 2026, Google released a Chrome Stable channel update for desktop, advancing the Stable channel to 149.0.7827.155/.156 for Windows and macOS and 149.0.7827.155 for Linux. The release bundles 33 security fixes, with 7 rated Critical and 26 rated High. The dominant defect class is use-after-free (CWE-416), the most reliable primitive for browser remote code execution because a freed renderer object can be reclaimed by attacker-controlled heap data and then dereferenced to gain control of execution.

The 7 Critical vulnerabilities span privacy- and credential-sensitive surfaces: CVE-2026-12437 (use-after-free in WebShare), CVE-2026-12438 (inappropriate implementation in WebView), CVE-2026-12439 and CVE-2026-12440 (use-after-free in Digital Credentials), CVE-2026-12441 (use-after-free in File Input), CVE-2026-12442 (use-after-free in Passwords), and CVE-2026-12443 (use-after-free in Web Authentication). All seven were found internally by Google between 2026-05-25 and 2026-06-11 using its memory-safety tooling. The cluster touching Digital Credentials, Passwords, and Web Authentication is notable because successful exploitation of those components risks exposure of stored credentials, passkeys/WebAuthn assertions, and verifiable digital identity material in addition to renderer code execution.

The 26 High-severity issues affect a broad set of components including Chromoting, Extensions, WebRTC, WebView, Media, Downloads, Browser, Input, Safe Browsing, Tab Strip, Serial, File System Access, Views, Metrics, Updater, and GPU. Confirmed examples include CVE-2026-12444 (out-of-bounds read in Chromoting), CVE-2026-12445 and CVE-2026-12467 (use-after-free in Extensions), CVE-2026-12447, CVE-2026-12461, and CVE-2026-12466 (heap buffer overflow / out-of-bounds read in WebRTC), CVE-2026-12448 (inappropriate implementation in WebView), and CVE-2026-12451 (use-after-free in Digital Credentials). The WebRTC defects can be reached via crafted audio/video or signaling traffic, broadening the attack surface beyond a simple page load.

The practical exploitation model is a classic drive-by: an attacker hosts or compromises a web page containing a malicious script that triggers one of the memory-corruption bugs when the victim navigates to it, with no further user interaction required. A renderer-level memory-corruption primitive is typically chained with a sandbox-escape bug for full system compromise; this update hardens both renderer surfaces (WebShare, File Input, WebRTC, Extensions) and higher-privilege surfaces (Browser, Updater, GPU). Google has restricted access to detailed bug entries and links until the majority of users are updated, a standard practice to limit n-day exploitation during the gradual rollout. Tenable scored the bundle at CVSS v3 9.8 / CVSS v2 10.0 and reports no known public exploits at time of disclosure; no confirmed in-the-wild exploitation is stated in any source. Users and fleet managers should force-update Chrome immediately rather than waiting for the staged rollout.

MITRE ATT&CK techniques used in TL-2026-0886

Collection

T1005 Data from Local System; T1185 Browser Session Hijacking

Defense Evasion

T1036 Masquerading; T1211 Exploitation for Stealth

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204 User Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Persistence

T1176 Software Extensions

Initial Access

T1189 Drive-by Compromise

Credential Access

T1212 Exploitation for Credential Access; T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores

Impact

T1499 Endpoint Denial of Service

Affected products and versions in Google Chrome 149 Multiple Memory-Corruption Vulnerabilities

  • Google — Chrome (Desktop, Windows)
    Vulnerable versions: < 149.0.7827.155
    Fixed in: 149.0.7827.155; 149.0.7827.156
  • Google — Chrome (Desktop, macOS)
    Vulnerable versions: < 149.0.7827.155
    Fixed in: 149.0.7827.155; 149.0.7827.156
  • Google — Chrome (Desktop, Linux)
    Vulnerable versions: < 149.0.7827.155
    Fixed in: 149.0.7827.155

Remediation for Google Chrome 149 Multiple Memory-Corruption Vulnerabilities

Patches

  • Chrome Stable 149.0.7827.155/.156 for Windows and macOS
  • Chrome Stable 149.0.7827.155 for Linux

Immediate actions

  • Force-update Google Chrome to 149.0.7827.155/.156 (Windows/macOS) or 149.0.7827.155 (Linux) immediately rather than waiting for the staged rollout; verify via chrome://settings/help and relaunch.
  • Push the update enterprise-wide via Chrome Browser Cloud Management / group policy and confirm version compliance across managed endpoints.

Workarounds

  • Until patched, avoid untrusted websites and disable unnecessary Chrome features (WebRTC, extensions, remote desktop) via policy; consider site isolation enforcement.

Longer-term hardening

  • Enable Chrome auto-update and minimum-version enforcement so endpoints cannot run below the fixed build.
  • Deploy EDR with behavioral detection for renderer-process anomalies and child-process spawning from chrome.exe.
  • Restrict high-risk surfaces via enterprise policy (disable unused WebRTC, Serial, File System Access, and remote-desktop/Chromoting features where not needed).

CVEs associated with Google Chrome 149 Multiple Memory-Corruption Vulnerabilities

Weaknesses (CWE) in Google Chrome 149 Multiple Memory-Corruption Vulnerabilities

CWE-416, CWE-122, CWE-125, CWE-787, CWE-362, CWE-457, CWE-451, CWE-20, CWE-863

Timeline of Google Chrome 149 Multiple Memory-Corruption Vulnerabilities

  • CVE-2026-12437 (use-after-free in WebShare) reported internally by Google.
  • CVE-2026-12438 (inappropriate implementation in WebView) reported internally by Google.
  • CVE-2026-12439 and CVE-2026-12440 (use-after-free in Digital Credentials) reported internally by Google.
  • CVE-2026-12441 (use-after-free in File Input) reported internally by Google.
  • CVE-2026-12442 (use-after-free in Passwords) reported internally by Google.
  • CVE-2026-12443 (use-after-free in Web Authentication) reported internally by Google.
  • Tenable publishes Nessus plugin 321274 covering Chrome < 149.0.7827.155, CVSS v3 9.8, no known public exploits.
  • Public reporting details 7 Critical and 26 High memory-corruption fixes; Google restricts detailed bug entries until most users update.
  • Google releases Chrome Stable 149.0.7827.155/.156 (Windows/macOS) and 149.0.7827.155 (Linux) with 33 security fixes; staged rollout begins.

Sources cited for Google Chrome 149 Multiple Memory-Corruption Vulnerabilities

Threats related to Google Chrome 149 Multiple Memory-Corruption Vulnerabilities

Detection coverage for TL-2026-0886

As of 2026-06-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0886 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats