Google Chrome fixes 151 vulnerabilities

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Google Chrome fixes 151 vulnerabilities

Google fixes 151 vulnerabilities in the Google Chrome browser and other browsers based on the Chromium engine. The fix has been released for Windows (148.0.7778.216/217), macOS (148.0.7778.215/216) and Linux (148.0.7778.215). Selected vulnerabilities are described below, the remaining ones can be found at [1]. The fix for the Microsoft Edge browser is available in version 150.0.4078.83 [2][3]. Details of the vulnerabilities have not yet been published, probably in accordance with responsible disclosure policies.

Google Chrome - out-of-bounds write (CVE-2026-9872, CVE-2026-9879)

CVSS 9.6 (Critical)

An unauthenticated remote attacker can write beyond the bounds of allocated memory without authorization, which may lead to an application crash, data modification or potentially even code execution [1].

The vulnerability is present in products:

Windows:Google Chrome; <148.0.7778.216;
macOS:Google Chrome; <148.0.7778.215;
Linux:Google Chrome; <148.0.7778.215;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

More information:

CVE-2026-9872 at cve.org, NVD
CVE-2026-9879 at cve.org, NVD
CWE-787: Out-of-bounds Write at cwe.mitre.org

The vulnerability was publicly disclosed 27. 5. 2026.

Google Chrome - use after free (CVE-2026-9873, CVE-2026-9874, CVE-2026-9876, CVE-2026-9877, CVE-2026-9878, CVE-2026-9881, CVE-2026-9883, CVE-2026-9884, CVE-2026-9886, CVE-2026-9887, CVE-2026-9888, CVE-2026-9890, CVE-2026-9891, CVE-2026-9893)

CVSS 9.6 (Critical)

An unauthenticated remote attacker can exploit a pointer to memory that has already been freed, which may lead to an application crash, unauthorized data modification or potentially even code execution [1].

The vulnerability is present in products:

Windows:Google Chrome; <148.0.7778.216;
macOS:Google Chrome; <148.0.7778.215;
Linux:Google Chrome; <148.0.7778.215;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

More information:

CVE-2026-9873 at cve.org, NVD
CVE-2026-9874 at cve.org, NVD
CVE-2026-9876 at cve.org, NVD
CVE-2026-9877 at cve.org, NVD
CVE-2026-9878 at cve.org, NVD
CVE-2026-9881 at cve.org, NVD
CVE-2026-9883 at cve.org, NVD
CVE-2026-9884 at cve.org, NVD
CVE-2026-9886 at cve.org, NVD
CVE-2026-9887 at cve.org, NVD
CVE-2026-9888 at cve.org, NVD
CVE-2026-9890 at cve.org, NVD
CVE-2026-9891 at cve.org, NVD
CVE-2026-9893 at cve.org, NVD
CWE-416: Use After Free at cwe.mitre.org

The vulnerability was publicly disclosed 27. 5. 2026.

Links

By CESNET, z.s.p.o. Michaela Ručková on 29. 5. 2026.

Report feedback

[TLP:CLEAR] Google Chrome fixes 151 vulnerabilities

Google Chrome - out-of-bounds write (CVE-2026-9872, CVE-2026-9879)

CVSS 9.6 (Critical)

Google Chrome - use after free (CVE-2026-9873, CVE-2026-9874, CVE-2026-9876, CVE-2026-9877, CVE-2026-9878, CVE-2026-9881, CVE-2026-9883, CVE-2026-9884, CVE-2026-9886, CVE-2026-9887, CVE-2026-9888, CVE-2026-9890, CVE-2026-9891, CVE-2026-9893)

CVSS 9.6 (Critical)

Links