Multiple security vulnerabilities have been identified in Chrome, affecting desktop builds prior to the current stable release. The issues include critical memory corruption flaws in graphics, rendering, and related components, as well as high-severity defects in the JavaScript engine and other subsystems. The overall risk is high because a malicious web page could potentially exploit these flaws to execute arbitrary code or compromise the browser. No active exploitation has been confirmed.
CVE-2026-121156 (CVSS 9.6 — Critical): An attacker could trigger a heap-based buffer overflow in Dawn, Chrome's WebGPU engine, by supplying crafted input through a malicious web page. Successful exploitation could allow arbitrary code execution within the browser process.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Chrome, affecting desktop builds prior to the current stable release. The issues include critical memory corruption flaws in graphics, rendering, and related components, as well as high-severity defects in the JavaScript engine and other subsystems. The overall risk is high because a malicious web page could potentially exploit these flaws to execute arbitrary code or compromise the browser. No active exploitation has been confirmed.
CVE-2026-121156 (CVSS 9.6 — Critical): An attacker could trigger a heap-based buffer overflow in Dawn, Chrome's WebGPU engine, by supplying crafted input through a malicious web page. Successful exploitation could allow arbitrary code execution within the browser process.[emaillocker id="1283"]
CVE-2026-121229 (CVSS 9.6 — Critical): A memory corruption flaw in ANGLE could be triggered by crafted graphics operations from a malicious web page. An attacker may be able to corrupt memory and execute arbitrary code.
CVE-2026-121246 (CVSS 9.6 — Critical): A use-after-free flaw in WebGL could be triggered when a malicious web page manipulates graphics objects after memory has been released. An attacker could potentially plant data in the freed memory and hijack execution to run arbitrary code.
CVE-2026-121035 (CVSS 9.6 — Critical): A use-after-free flaw in Prerender could be triggered by crafted prerendering activity from a malicious web page. An attacker may be able to exploit the stale memory reference to execute arbitrary code.
CVE-2026-121247 (CVSS 9.6 — Critical): An attacker could trigger a heap-based buffer overflow in Dawn, Chrome's WebGPU engine, by supplying crafted input through a malicious web page. Successful exploitation could allow arbitrary code execution within the browser process.
CVE-2026-121126 (CVSS 9.6 — Critical): A use-after-free flaw in Core could be triggered by crafted browser operations from a malicious web page. An attacker may be able to exploit the stale memory reference to execute arbitrary code.
CVE-2026-121203 (CVSS 8.8 — High): A use-after-free flaw in Geometry could be triggered by crafted geometry processing from a malicious web page. An attacker may be able to exploit the stale memory reference to execute arbitrary code.
These vulnerabilities collectively present a serious risk to desktop users, especially those who browse untrusted content or run outdated browser builds. The most at risk are environments that delay browser maintenance and expose users to malicious web content. The general action is to prioritize affected desktop deployments for security review and monitoring.
We recommend you to update Chrome to version 157.0.8103.38 on Linux, 157.0.8103.38/.39 on Windows and Mac, or 156.0.8078.88 for Extended Stable on Windows and Mac depending on your installed branch.
The following reports contain further technical details:
[/emaillocker]