Massive Patch Release Addresses Widespread Browser Flaws
Google has pushed a substantial security update to the stable channel of Chrome, version 149.0.7827.53, addressing a record 429 unique security vulnerabilities. The update is available for Windows, macOS, and Linux, with coordinated fixes for Chrome on iOS, Chromecast, and other ecosystem components that share core browser code. This is one of the largest single release patch bundles in the browser’s history.
The sweeping update covers vulnerabilities across the browser engine, graphics and GPU layers, media pipeline, user interface, networking stack, and Chrome specific features such as Autofill, Password Manager, and DevTools. As is standard practice, Google is restricting access to detailed bug tracker entries until most users have updated, to prevent attackers from weaponizing the information before patches are widely deployed.
Critical and High Severity Risks Addressed
Among the 429 vulnerabilities, 22 are classified as critical, with many stemming from memory safety defects in graphics and core browser components. These include out of bounds read and write issues in the ANGLE graphics layer, a stack buffer overflow in the GPU stack, and multiple use after free conditions across networking, Chromecast, Chromoting, and printing components. Such flaws are prime candidates for remote code execution, sandbox escape, and privilege escalation when combined with weaknesses in the renderer or JavaScript engine.
Beyond the critical issues, Google also addressed a substantial number of high severity vulnerabilities that are directly reachable from web content. These include type confusion and implementation bugs in the V8 JavaScript engine, use after free conditions in WebRTC, WebAuthentication, Audio, and FileSystem components, as well as integer overflows in Dawn, DevTools, and Media components. For enterprise environments where Chrome serves as a primary defense against untrusted web content and SaaS applications, this update represents a broad hardening step across multiple devices.
Source: Cyber Security News
