# Google Chrome 150.0.7871.181/.182 Patches 12 High-Severity Vulnerabilities (CVE-2026-16413 through CVE-2026-16424)

> Google shipped Chrome 150.0.7871.181/.182 (Windows/macOS/Linux) fixing 12 High-severity memory-safety and validation bugs across ANGLE, Chromecast, Extensions, Skia, V8, WebAudio, Certificate handling, UI, and GPU. No active exploitation was confirmed and the batch is not listed in the CISA KEV catalog; Google withheld technical details pending broader update adoption, per its standard disclosure policy.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T09:24:54.584Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1605
- **ID:** TL-2026-1605
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-16413, CVE-2026-16414, CVE-2026-16415, CVE-2026-16416, CVE-2026-16417, CVE-2026-16418, CVE-2026-16419, CVE-2026-16420, CVE-2026-16421, CVE-2026-16422, CVE-2026-16423, CVE-2026-16424

## Description

On 2026-07-22, Google published a Chrome Stable channel security update raising the browser to version 150.0.7871.181/.182 on Windows and macOS, and 150.0.7871.181 on Linux. The release addresses 12 vulnerabilities, all rated High severity by the Chromium security team, spanning nine distinct components: ANGLE (2 bugs — CVE-2026-16413 out-of-bounds write, CVE-2026-16419 out-of-bounds read and write), Chromecast (2 bugs — CVE-2026-16414 insufficient validation of untrusted input, CVE-2026-16416 integer overflow, both requiring a local attacker on the network), Extensions (1 bug — CVE-2026-16415 insufficient validation of untrusted input), Skia (1 bug — CVE-2026-16417 uninitialized use), V8 (1 bug — CVE-2026-16418 stack buffer overflow enabling in-sandbox code execution), WebAudio (2 bugs — CVE-2026-16420 type confusion and CVE-2026-16421 inappropriate implementation, both enabling in-sandbox code execution via a crafted HTML page), Certificate handling on Linux (1 bug — CVE-2026-16422 insufficient validation enabling domain spoofing by an attacker in a privileged network position), UI (1 bug — CVE-2026-16423 use-after-free), and GPU on Android (1 bug — CVE-2026-16424 use-after-free enabling sandbox escape by an attacker who has already compromised the renderer process).

Ten of the twelve bugs were found and reported internally by Google's own security engineering and fuzzing infrastructure, which per Google's public tooling disclosures relies on AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL to surface memory-safety classes before external discovery. The remaining two — CVE-2026-16420 and CVE-2026-16421, both WebAudio bugs — were discovered and reported externally by XBOW, an autonomous AI-driven vulnerability-research system, and triaged by researcher Brendan Dolan-Gavitt; each report earned a $500 bounty under Chrome's Vulnerability Reward Program. This is notable as an early example of AI-agent-driven fuzzing/bug-hunting directly contributing disclosed CVEs to a mass-market browser, a trend expected to accelerate discovery of memory-safety classes (UAF, type confusion, OOB, stack overflow) that have historically dominated in-the-wild Chrome exploit chains.

The memory-corruption bugs (V8 stack buffer overflow, the two ANGLE OOB bugs, the GPU and UI use-after-frees, and the WebAudio type-confusion/inappropriate-implementation pair) are the highest-value entries for exploit development: V8 and ANGLE sit directly in the JavaScript-engine and GPU/graphics-abstraction attack surface that has historically anchored real-world Chrome sandbox-escape and remote-code-execution chains, and the GPU UAF on Android is described by the vendor as reachable by an attacker who has already compromised the renderer process — i.e., a second-stage bug suited for chaining after an initial renderer-process compromise (e.g., via the V8 or WebAudio bugs in this same batch) to escape the Chrome sandbox. The Extensions bug (CVE-2026-16415) and the Certificate-validation bug (CVE-2026-16422) round out the batch with input-validation and trust-control weaknesses rather than pure memory corruption: the former could allow a malicious or compromised extension update/input to be processed unsafely, while the latter allows an on-path/privileged-network-position attacker to spoof a domain to a Linux Chrome client by exploiting insufficient certificate validation — functionally an adversary-in-the-middle primitive.

Google has confirmed no in-the-wild exploitation of any of the 12 CVEs at time of disclosure, and none of the 12 identifiers appear in the CISA Known Exploited Vulnerabilities (KEV) catalog as of 2026-07-22. Consistent with Chromium's standard disclosure policy, Google restricted access to the underlying bug-tracker entries and did not publish PoC or technical root-cause detail, to slow reverse-engineering of the fixes into working exploits while the patched build rolls out to the broader user base over the following days/weeks. Defenders should treat this as a routine but high-volume patch-adoption and browser-fleet-hygiene event: 12 High-severity memory-safety fixes in a single release is an above-average batch size, and the historical base rate for silent 1-day weaponization of Chrome memory-corruption bugs (once technical details leak or are independently rediscovered) means enterprise patch cadence for Chrome/Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should be prioritized accordingly.

## MITRE ATT&CK

- T1592 Gather Victim Host Information
- T1583.001 Domains
- T1588.005 Exploits
- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1204.001 Malicious Link
- T1176 Software Extensions
- T1068 Exploitation for Privilege Escalation
- T1055 Process Injection
- T1211 Exploitation for Stealth
- T1685 Disable or Modify Tools
- T1557 Adversary-in-the-Middle
- T1217 Browser Information Discovery
- T1185 Browser Session Hijacking
- T1071 Application Layer Protocol
- T1499 Endpoint Denial of Service

## Sources

- [Google Chrome Update Fixes 12 High-Severity Vulnerabilities That Enable Browser Attacks](https://gbhackers.com/google-chrome-update-fixes-12-high-severity-vulnerabilities-that-enable-browser-attacks/)
- [Google Chrome Update Fixes 12 Vulnerabilities That Could Enable Browser Attacks](https://cybersecuritynews.com/chrome-update-fixes-12-vulnerabilities/)
- [Google Chrome Update Fixes 12 High-Severity Browser Vulnerabilities](https://cyberpress.org/google-chrome-update-12-browser-vulnerabilities/)
- [Chrome Releases: Stable Channel Update for Desktop](https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html)
- [CVE-2026-16413 | THREATINT](https://cve.threatint.com/CVE/CVE-2026-16413)
- [CVE-2026-16418 | THREATINT](https://cve.threatint.com/CVE/CVE-2026-16418)
- [CVE-2026-16420 | THREATINT](https://cve.threatint.com/CVE/CVE-2026-16420)
- [CVE-2026-16421 | THREATINT](https://cve.threatint.com/CVE/CVE-2026-16421)
- [CVE-2026-16422 | THREATINT](https://cve.threatint.com/CVE/CVE-2026-16422)
- [CVE-2026-16424 | THREATINT](https://cve.threatint.com/CVE/CVE-2026-16424)
- [CVE-2026-16414 | THREATINT](https://cve.threatint.com/CVE/CVE-2026-16414)
- [CVE-2026-16416 | THREATINT](https://cve.threatint.com/CVE/CVE-2026-16416)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [XBOW — Autonomous AI Penetration Testing / Vulnerability Research](https://xbow.com/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1605