Critical Chrome Vulnerabilities Allow Arbitrary Code Execution

Google has officially rolled out Chrome 147 to the stable channel for Windows, Mac, and Linux, delivering one of the most significant security patch batches in recent memory, patching two critical vulnerabilities and more than a dozen high-severity flaws that could expose billions of users to remote code execution and memory corruption attacks.

Released on April 7, 2026, Chrome 147.0.7727.55 (Linux) and 147.0.7727.55/56 (Windows/Mac) is currently rolling out to users over the coming days and weeks.

Two Critical Flaws at the Core

At the heart of this security release are twin critical-severity vulnerabilities residing in Chrome’s WebML (Web Machine Learning) component, the API responsible for hardware-accelerated machine learning operations inside the browser.

CVE-2026-5858 is a heap buffer overflow in WebML, reported on March 17, 2026. The flaw allows a remote attacker to execute arbitrary code via a specially crafted HTML page. Google awarded a $43,000 bug bounty for its discovery reflecting the severity of the impact.

CVE-2026-5859 is an integer overflow in WebML, reported anonymously on March 19, 2026, and rewarded with a $43,000 bounty.

Both vulnerabilities can be triggered simply by luring a user to an attacker-controlled webpage, where malicious HTML corrupts heap memory, opening the door to full code execution within the browser process.

High-Severity Bugs Patched

Beyond the critical pair, Chrome 147 addresses 14 high-severity vulnerabilities spanning multiple browser subsystems:

• CVE-2026-5860 & CVE-2026-5861 — Use-after-free flaws in WebRTC and V8 respectively, each rewarded with $11,000 and $3,000 bounties
• CVE-2026-5862 & CVE-2026-5863 — Inappropriate implementation bugs in the V8 JavaScript engine, reported internally by Google
• CVE-2026-5864 — Heap buffer overflow in WebAudio, discovered by researcher Syn4pse
• CVE-2026-5865 & CVE-2026-5871 — Type confusion vulnerabilities in V8, which can allow memory misinterpretation leading to code execution
• CVE-2026-5866 — Use-after-free in the Media subsystem
• CVE-2026-5867 & CVE-2026-5869 — Additional heap buffer overflows in WebML
• CVE-2026-5868 — Heap buffer overflow in ANGLE, Chrome’s graphics abstraction layer
• CVE-2026-5870 — Integer overflow in the Skia graphics library
• CVE-2026-5872 & CVE-2026-5873 — Use-after-free in Blink and out-of-bounds read/write in V8, both flagged internally by Google

Medium and Low Severity Issues

Chrome 147 also closes 20 medium-severity and 24 low-severity vulnerabilities across a broad attack surface.

Notable medium-severity patches include a use-after-free in PrivateAI (CVE-2026-5874), a policy bypass in Blink (CVE-2026-5875), a side-channel information leakage in Navigation (CVE-2026-5876), and a cryptographic flaw in PDFium (CVE-2026-5889).

A race condition in WebCodecs (CVE-2026-5890) and insufficient policy enforcement in Progressive Web Apps (CVE-2026-5892) round out the significant medium-tier concerns.

Low-severity fixes address incorrect security UI presentations across multiple components, including Omnibox, Downloads, Permissions, and History Navigation, as well as policy bypass issues in ServiceWorkers, DevTools, and IFrameSandbox.

According to Google Advisory, users can force an immediate update by navigating to Chrome Menu → Help → About Google Chrome, which will trigger a check for the latest version. A browser restart is required to fully apply the patch.

Organizations running enterprise deployments should prioritize pushing version 147.0.7727.55/56 across their fleets without delay.