Google Chrome 150.0.7871.181/.182 Patches 12 High-Severity Vulnerabilities (CVE-2026-16413 through CVE-2026-16424) — Threadlinqs Intelligence
As of 2026-07-22, Google Chrome 150.0.7871.181/.182 Patches 12 High-Severity Vulnerabilities (CVE-2026-16413 through CVE-2026-16424) is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-1605 · Severity: HIGH · Status: PATCHED · Category: VULNERABILITY
Updated: 2026-07-22 · revalidated 1× · latest source
Google shipped Chrome 150.0.7871.181/.182 (Windows/macOS/Linux) fixing 12 High-severity memory-safety and validation bugs across ANGLE, Chromecast, Extensions, Skia, V8, WebAudio, Certificate
On 2026-07-22, Google published a Chrome Stable channel security update raising the browser to version 150.0.7871.181/.182 on Windows and macOS, and 150.0.7871.181 on Linux. The release addresses 12 vulnerabilities, all rated High severity by the Chromium security team, spanning nine distinct components: ANGLE (2 bugs — CVE-2026-16413 out-of-bounds write, CVE-2026-16419 out-of-bounds read and write), Chromecast (2 bugs — CVE-2026-16414 insufficient validation of untrusted input, CVE-2026-16416 integer overflow, both requiring a local attacker on the network), Extensions (1 bug — CVE-2026-16415 insufficient validation of untrusted input), Skia (1 bug — CVE-2026-16417 uninitialized use), V8 (1 bug — CVE-2026-16418 stack buffer overflow enabling in-sandbox code execution), WebAudio (2 bugs — CVE-2026-16420 type confusion and CVE-2026-16421 inappropriate implementation, both enabling in-sandbox code execution via a crafted HTML page), Certificate handling on Linux (1 bug — CVE-2026-16422 insufficient validation enabling domain spoofing by an attacker in a privileged network position), UI (1 bug — CVE-2026-16423 use-after-free), and GPU on Android (1 bug — CVE-2026-16424 use-after-free enabling sandbox escape by an attacker who has already compromised the renderer process).
Ten of the twelve bugs were found and reported internally by Google's own security engineering and fuzzing infrastructure, which per Google's public tooling disclosures relies on AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL to surface memory-safety classes before external discovery. The remaining two — CVE-2026-16420 and CVE-2026-16421, both WebAudio bugs — were discovered and reported externally by XBOW, an autonomous AI-driven vulnerability-research system, and triaged by researcher Brendan Dolan-Gavitt; each report earned a $500 bounty under Chrome's Vulnerability Reward Program. This is notable as an early example of AI-agent-driven fuzzing/bug-hunting directly contributing disclosed CVEs to a mass-market browser, a trend expected to accelerate discovery of memory-safety classes (UAF, type confusion, OOB, stack overflow) that have historically dominated in-the-wild Chrome exploit chains.
The memory-corruption bugs (V8 stack buffer overflow, the two ANGLE OOB bugs, the GPU and UI use-after-frees, and the WebAudio type-confusion/inappropriate-implementation pair) are the highest-value entries for exploit development: V8 and ANGLE sit directly in the JavaScript-engine and GPU/graphics-abstraction attack surface that has historically anchored real-world Chrome sandbox-escape and remote-code-execution chains, and the GPU UAF on Android is described by the vendor as reachable by an attacker who has already compromised the renderer process — i.e., a second-stage bug suited for chaining after an initial renderer-process compromise (e.g., via the V8 or WebAudio bugs in this same batch) to escape the Chrome sandbox. The Extensions bug (CVE-2026-16415) and the Certificate-validation bug (CVE-2026-16422) round out the batch with input-validation and trust-control weaknesses rather than pure memory corruption: the former could allow a malicious or compromised extension update/input to be processed unsafely, while the latter allows an on-path/privileged-network-position attacker to spoof a domain to a Linux Chrome client by exploiting insufficient certificate validation — functionally an adversary-in-the-middle primitive.
Google has confirmed no in-the-wild exploitation of any of the 12 CVEs at time of disclosure, and none of the 12 identifiers appear in the CISA Known Exploited Vulnerabilities (KEV) catalog as of 2026-07-22. Consistent with Chromium's standard disclosure policy, Google restricted access to the underlying bug-tracker entries and did not publish PoC or technical root-cause detail, to slow reverse-engineering of the fixes into working exploits while the patched build rolls out to the broader us
Weaknesses (CWE)
CWE-787, CWE-20, CWE-190, CWE-457, CWE-121, CWE-125, CWE-843, CWE-1288, CWE-416
Target sectors: all-sectors, enterprise, consumer, government administration, education, technology
Target regions: Global
Detections & IOCs
As of 2026-07-22, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-16413, CVE-2026-16414, CVE-2026-16415, CVE-2026-16416, CVE-2026-16417, CVE-2026-16418, CVE-2026-16419, CVE-2026-16420, CVE-2026-16421, CVE-2026-16422, T1592, T1583.001, T1588.005, T1189, T1190, T1203, T1204.001, T1176, T1068, T1055