Chrome Security Update: Fix for Multiple CVEs (UAF, Heap Overflow)

Vulnerability Overview This webpage summarizes multiple security vulnerabilities fixed in the Google Chrome Stable Channel updates. These vulnerabilities involve various types, including memory management errors, insufficient input validation, and improper policy enforcement. Scope of Impact Operating Systems: Windows, Mac, and Linux. Versions: 149.0.7827.114/115 (Windows and Mac), 149.0.7827.114 (Linux). Vulnerability Types: - Use after free (Use of uninitialized memory) - Insufficient validation of untrusted input - Heap buffer overflow - Inappropriate implementation - Out of bounds read - Insufficient policy enforcement Remediation Update Chrome: Users should update to the latest version as soon as possible (149.0.7827.114/115 for Windows and Mac, 149.0.7827.114 for Linux). Security Research: Google thanks all external researchers who participated in security research and has provided links to detailed vulnerability reports. Detection Tools: Many security vulnerabilities were detected using tools such as AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, InFuzzer, or AFL. Vulnerability Details Below are detailed descriptions of some key vulnerabilities: 1. CVE-2026-12007 - Type: Use after free - Component: Core - Reporter: Google - Date: 2026-05-26 2. CVE-2026-12008 - Type: Use after free - Component: DigitalCredentials - Reporter: Google - Date: 2026-05-27 3. CVE-2026-12009 - Type: Insufficient validation of untrusted input - Component: Accessibility - Reporter: Google - Date: 2026-05-28 4. CVE-2026-12010 - Type: Heap buffer overflow - Component: GPU - Reporter: Google - Date: 2026-05-28 5. CVE-2026-12011 - Type: Use after free - Component: WebMIDI - Reporter: Google - Date: 2026-05-30 6. CVE-2026-12012 - Type: Use after free - Component: Network - Reporter: Google - Date: 2026-04-03 7. CVE-2026-12013 - Type: Use after free - Component: Media - Reporter: Henrick Hable (Independent Security Researcher) - Date: 2026-05-19 8. CVE-2026-12014 - Type: Use after free - Component: Cast - Reporter: Google - Date: 2026-05-19 9. CVE-2026-12015 - Type: Use after free - Component: Autofill - Reporter: Google - Date: 2026-05-21 10. CVE-2026-12016 - Type: Insufficient validation of untrusted input - Component: DevTools - Reporter: Google - Date: 2026-05-25 11. CVE-2026-12017 - Type: Insufficient validation of untrusted input - Component: Extensions - Reporter: Google - Date: 2026-05-26 12. CVE-2026-12018 - Type: Inappropriate implementation - Component: Mojo - Reporter: Google - Date: 2026-05-26 13. CVE-2026-12019 - Type: Out of bounds write - Component: Codecs - Reporter: Google - Date: 2026-05-26 14. CVE-2026-12020 - Type: Use after free - Component: Autofill - Reporter: Google - Date: 2026-05-27 15. CVE-2026-12022 - Type: Race - Component: Safe Browsing - Reporter: Google - Date: 2026-05-27 16. CVE-2026-12023 - Type: Use after free - Component: GPU - Reporter: Google - Date: 2026-05-27 17. CVE-2026-12024 - Type: Insufficient policy enforcement - Component: DevTools - Reporter: Google - Date: 2026-05-27 18. CVE-2026-12025 - Type: Insufficient validation of untrusted input - Component: Network - Reporter: Google - Date: 2026-05-27 19. CVE-2026-12026 - Type: Out of bounds read - Component: Video - Reporter: Google - Date: 2026-05-28 20. CVE-2026-12027 - Type: Insufficient policy enforcement - Component: Headless - Reporter: Google - Date: 2026-05-28 21. CVE-2026-12028 - Type: Use after free - Component: GPU - Reporter: Google - Date: 2026-05-28 22. CVE-2026-12029 - Type: Use after free - Component: Video - Reporter: Google - Date: 2026-05-29 23. CVE-2026-12030 - Type: Heap buffer overflow - Component: GPU - Reporter: Google - Date: 2026-05-29 24. CVE-2026-12031 - Type: Inappropriate implementation - Component: Views - Reporter: Google - Date: 2026-05-30 25. CVE-2026-12032 - Type: Inappropriate implementation - Component: Passwords - Reporter: Google - Date: 2026-05-30 26. CVE-2026-12033 - Type: Out of bounds read - Component: VideoCapture - Reporter: Google - Date: 2026-06-02 27. CVE-2026-12034 - Type: Insufficient validation of untrusted input - Component: Linux Toolkit Theming - Reporter: Google - Date: 2026-06-02 28. CVE-2026-12035 - Type: Use after free - Component: Views - Reporter: Google - Date: 2026-06-05 Summary This update fixes 28 security vulnerabilities involving various types and components. Users should immediately update Chrome to the latest version to ensure security. Google thanks all external researchers who participated in security research and has provided links to detailed vulnerability reports.

Goal Reached Thanks to every supporter — we hit 100%!

Chrome Security Update: Fix for Multiple CVEs (UAF, Heap Overflow)