# Google Chrome 149 Multiple Memory-Corruption Vulnerabilities Enable Arbitrary Code Execution (CVE-2026-12437 through CVE-2026-12469)

> Google shipped Chrome Stable 149.0.7827.155/.156 (Windows/macOS) and 149.0.7827.155 (Linux) on 2026-06-17 with 33 security fixes, including 7 Critical use-after-free / inappropriate-implementation flaws in WebShare, WebView, Digital Credentials, File Input, Passwords, and Web Authentication, plus 26 High-severity memory-corruption bugs. A victim simply visiting a malicious webpage could trigger exploitation leading to arbitrary code execution in the renderer. No in-the-wild exploitation is confirmed in the sources.

- **Published:** 2026-06-20T00:00:00Z
- **Last reviewed:** 2026-06-20T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0886
- **ID:** TL-2026-0886
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-12437, CVE-2026-12438, CVE-2026-12439, CVE-2026-12440, CVE-2026-12441, CVE-2026-12442, CVE-2026-12443, CVE-2026-12444, CVE-2026-12445, CVE-2026-12446, CVE-2026-12447, CVE-2026-12448, CVE-2026-12449, CVE-2026-12450, CVE-2026-12451, CVE-2026-12453, CVE-2026-12456, CVE-2026-12457, CVE-2026-12460, CVE-2026-12461, CVE-2026-12462, CVE-2026-12464, CVE-2026-12465, CVE-2026-12466, CVE-2026-12467, CVE-2026-12469

## Description

On June 17, 2026, Google released a Chrome Stable channel update for desktop, advancing the Stable channel to 149.0.7827.155/.156 for Windows and macOS and 149.0.7827.155 for Linux. The release bundles 33 security fixes, with 7 rated Critical and 26 rated High. The dominant defect class is use-after-free (CWE-416), the most reliable primitive for browser remote code execution because a freed renderer object can be reclaimed by attacker-controlled heap data and then dereferenced to gain control of execution.

The 7 Critical vulnerabilities span privacy- and credential-sensitive surfaces: CVE-2026-12437 (use-after-free in WebShare), CVE-2026-12438 (inappropriate implementation in WebView), CVE-2026-12439 and CVE-2026-12440 (use-after-free in Digital Credentials), CVE-2026-12441 (use-after-free in File Input), CVE-2026-12442 (use-after-free in Passwords), and CVE-2026-12443 (use-after-free in Web Authentication). All seven were found internally by Google between 2026-05-25 and 2026-06-11 using its memory-safety tooling. The cluster touching Digital Credentials, Passwords, and Web Authentication is notable because successful exploitation of those components risks exposure of stored credentials, passkeys/WebAuthn assertions, and verifiable digital identity material in addition to renderer code execution.

The 26 High-severity issues affect a broad set of components including Chromoting, Extensions, WebRTC, WebView, Media, Downloads, Browser, Input, Safe Browsing, Tab Strip, Serial, File System Access, Views, Metrics, Updater, and GPU. Confirmed examples include CVE-2026-12444 (out-of-bounds read in Chromoting), CVE-2026-12445 and CVE-2026-12467 (use-after-free in Extensions), CVE-2026-12447, CVE-2026-12461, and CVE-2026-12466 (heap buffer overflow / out-of-bounds read in WebRTC), CVE-2026-12448 (inappropriate implementation in WebView), and CVE-2026-12451 (use-after-free in Digital Credentials). The WebRTC defects can be reached via crafted audio/video or signaling traffic, broadening the attack surface beyond a simple page load.

The practical exploitation model is a classic drive-by: an attacker hosts or compromises a web page containing a malicious script that triggers one of the memory-corruption bugs when the victim navigates to it, with no further user interaction required. A renderer-level memory-corruption primitive is typically chained with a sandbox-escape bug for full system compromise; this update hardens both renderer surfaces (WebShare, File Input, WebRTC, Extensions) and higher-privilege surfaces (Browser, Updater, GPU). Google has restricted access to detailed bug entries and links until the majority of users are updated, a standard practice to limit n-day exploitation during the gradual rollout. Tenable scored the bundle at CVSS v3 9.8 / CVSS v2 10.0 and reports no known public exploits at time of disclosure; no confirmed in-the-wild exploitation is stated in any source. Users and fleet managers should force-update Chrome immediately rather than waiting for the staged rollout.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1212 Exploitation for Credential Access
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1185 Browser Session Hijacking
- T1005 Data from Local System
- T1204 User Execution
- T1176 Software Extensions
- T1036 Masquerading
- T1041 Exfiltration Over C2 Channel
- T1499 Endpoint Denial of Service

## Sources

- [Multiple Google Chrome Vulnerabilities Let Attackers Execute Arbitrary Code](https://cybersecuritynews.com/chrome-vulnerabilities-execute-arbitrary-code/)
- [Chrome Releases: Stable Channel Update for Desktop](https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html)
- [Google Chrome < 149.0.7827.155 Multiple Vulnerabilities (Nessus Plugin 321274)](https://www.tenable.com/plugins/nessus/321274)
- [Critical Chrome Vulnerabilities Allow Attackers to Execute Arbitrary Code - Update Now!](https://www.cryptika.com/critical-chrome-vulnerabilities-allow-attackers-to-execute-arbitrary-code-update-now/)
- [Critical Chrome Flaws Let Attackers Execute Arbitrary Code - Update Immediately](https://gbhackers.com/critical-chrome-flaws-2/)
- [Latest Chrome update fixes 7 critical flaws that could let attackers take over your browser](https://piunikaweb.com/2026/06/18/chrome-security-update-june-2026-7-critical-fixes/)
- [Google Chrome 149.0.7827.156 (offline installer)](https://www.neowin.net/software/google-chrome-14907827156-offline-installer/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0886