Google has pushed out a new Stable-channel update for Chrome that patches a dozen security vulnerabilities, nine of which carry a “High” severity rating. The update brings desktop Chrome to version 150.0.7871.181/.182 on Windows and Mac and 150.0.7871.181 on Linux, with the rollout reaching the full user base over the coming days and weeks.

Why This Update Matters More Than Most

Several of the fixed bugs share a common thread: they involve memory corruption, meaning a successful exploit could let an attacker run arbitrary code, crash the browser, or slip past security checks simply by getting a victim to load a malicious web page. That kind of vulnerability doesn’t require a user to download or install anything — visiting the wrong site is enough to trigger it.

Where the Bugs Live

The fixes span a wide swath of Chrome’s internals, including the V8 JavaScript engine, the ANGLE graphics layer, the Skia rendering library, GPU handling, the browser UI, the extensions system, and Chromecast support. Among the more notable issues:

• An out-of-bounds write in ANGLE and a separate out-of-bounds read/write, also in ANGLE
• A stack buffer overflow in V8, Chrome’s JavaScript engine — a component that sits directly in the path of nearly every web page a user visits
• Two use-after-free bugs, one in the GPU process and one in the browser UI
• An uninitialized-use bug in Skia, Chrome’s 2D graphics library
• Insufficient input validation across Chromecast, extensions, and certificate handling
• An integer overflow affecting Chromecast

The V8 stack overflow and the two use-after-free bugs in GPU and UI code are the standout entries here, since all three touch components that are common building blocks in real-world browser exploit chains — attackers frequently combine a rendering bug with a sandbox-escape bug to gain full code execution.

An AI System Gets Two of the Credits

Two of the patched flaws — both affecting WebAudio — were flagged not by a human researcher but by XBOW, an autonomous AI-driven security research system, with the findings triaged by researcher Brendan Dolan-Gavitt. Each discovery earned a $500 bounty. The remaining ten issues came out of Google’s own internal security testing, identified between late May and mid-July 2026. It’s a small but telling data point in the broader trend of AI-assisted tools increasingly finding real, exploitable bugs in major software products.

How Google Catches These Before Release

Google credits its automated testing pipeline — including AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL — with catching the bulk of these memory-safety problems before they ever reach a shipped version of Chrome. As is standard practice, Google is withholding full technical detail on several of the bugs until a majority of users have updated, or until a fix for an underlying shared library is available elsewhere.

What to Do About It

Given the number of high-severity, memory-corruption bugs bundled into a single release, security teams shouldn’t wait for Chrome’s automatic background update to catch up on every machine. Individual users can force the update manually:

• Open Chrome and click the three-dot menu in the top-right corner
• Go to Help > About Google Chrome
• Let Chrome check for and install the latest version
• Restart the browser to complete the update

Enterprises managing Chrome across fleets of endpoints should treat this as a priority push through their device-management tooling. With multiple high-severity memory-corruption issues landing in the same release, the realistic risk is that they could be chained together into a more complete exploit — which is exactly the scenario patch management is meant to prevent.