Loading story…
Google released a Chrome Stable Channel update for desktop (Chrome 145) to address multiple security vulnerabilities in versions prior to 145.0.7632.45/46 (Windows/macOS) and 145.0.7632.45 (Linux), and the Canadian Centre for Cyber Security urged organizations to apply the update when available. The most severe issue reported publicly is CVE-2026-2313, a use-after-free in CSS that could enable arbitrary code execution; additional high-severity fixes include CVE-2026-2314 (heap buffer overflow in Codecs) and CVE-2026-2315 (inappropriate implementation in WebGPU), alongside several medium/low-severity issues across components such as Frames, DevTools, Ozone, File input, and Downloads.
Separate from the Chrome release, the Canadian Centre for Cyber Security also published multiple vendor advisories covering unrelated vulnerability sets across enterprise infrastructure and software, including HPE (ProLiant/Synergy/Alletra/Aruba EdgeConnect/StoreEasy and Intel E810 controller firmware), Intel (multiple products), Fortinet (FortiOS, FortiClient Windows, FortiAuthenticator, FortiSandbox), Dell (SmartFabric Manager), and IBM (webMethods Integration, InfoSphere Information Server, Watson Discovery Cartridge, API Connect, OpenPages, and Common Cryptographic Architecture). These notices are general patch advisories and do not describe a single shared incident or exploit campaign tied to the Chrome vulnerabilities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-12, Google released a Chrome stable-channel security update addressing 79 vulnerabilities across components including WebML, Skia, Blink, V8, GPU, Media, Downloads, and Payments. Google temporarily restricted bug details until users and dependent third parties could patch, and listed critical issues such as heap buffer overflows, integer overflows, use-after-free bugs, race conditions, and insufficient validation flaws.
On 2026-03-10, Google published a Chrome stable-channel update for desktop via the Chrome Releases blog. This is a separate Chrome release event from the February and May advisories already in the timeline and likely corresponds to a new batch of browser fixes.
On 2026-02-15, Debian published security advisory DSA 6135-1 for chromium, indicating downstream distribution of fixes for the Chrome/Chromium vulnerabilities. The advisory marks a package-level security update for Debian users.
On 2026-02-11, the Canadian Centre for Cyber Security issued advisory AV26-116 referencing Google's Chrome security update. It advised users and administrators to review Google's bulletin and update affected Chrome versions prior to 145.0.7632.45/46 on Windows and Mac and 145.0.7632.45 on Linux.
On 2026-02-10, Google released Chrome 145 to the stable channel for Windows, macOS, and Linux and published a security advisory covering 11 patched vulnerabilities. The fixes included high-severity issues such as CVE-2026-2313 in CSS, plus additional high-, medium-, and low-severity flaws affecting multiple browser components.
6 references tracked. Mallory keeps watching after this page renders.
chromereleases.googleblog.com
Open sourcechromereleases.googleblog.com
Open sourcechromereleases.googleblog.com
Open sourcelists.debian.org
Open sourcecybersecuritynews.com
Open sourcecyber.gc.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released a **Chrome Stable Channel** security update for desktop, shipping **145.0.7632.116/117** for Windows and macOS and **144.0.7559.116** for Linux, and urged users to apply updates as they roll out. The Canadian Centre for Cyber Security echoed the guidance in advisory **AV26-159**, recommending administrators review Google’s bulletin and deploy the patched versions to address the disclosed vulnerabilities. Reporting on the release described an “emergency” update that fixes **three High-severity CVEs**, including multiple **out-of-bounds memory access** issues with potential exploitation impact (e.g., memory corruption that can contribute to remote code execution or exploit chains). The vulnerabilities highlighted include `CVE-2026-3061` (out-of-bounds read in Chrome’s **Media** component, reported by Luke Francis) and `CVE-2026-3062` (out-of-bounds read/write in **Tint** / WebGPU shader compiler, reported by Cinzinga), with the update recommended for rapid enterprise deployment due to the risk posed by unpatched browsers.
Jun 29, 2026
Google released security updates for **Chrome Stable Channel on Desktop** to address vulnerabilities affecting Windows, macOS, and Linux systems. One advisory covered versions prior to **`146.0.7680.164/165`** on Windows and macOS and **`146.0.7680.164`** on Linux, with the Canadian Centre for Cyber Security urging organizations to review Google’s bulletin and deploy updates as they become available. A subsequent advisory addressed additional Chrome desktop flaws in versions prior to **`147.0.7727.55/56`** on Windows and macOS and **`147.0.7727.55`** on Linux. The Canadian Centre for Cyber Security again called on users and administrators to apply the latest browser updates promptly, underscoring continued patching activity for Chrome across supported desktop platforms.
Jun 29, 2026
Google released an emergency update for *Chrome for Desktop* to **Stable channel 145.0.7632.159/160 (Windows/macOS)** and **145.0.7632.159 (Linux)**, addressing **10 security vulnerabilities**, including **three Critical** issues. Reported flaws include `CVE-2026-3536` (integer overflow in **ANGLE**), `CVE-2026-3537` (object lifecycle issue in **PowerVR**), and `CVE-2026-3538` (integer overflow in **Skia**); additional **High-severity** bugs span components such as **V8**, **WebAssembly**, **CSS**, **DevTools**, and media-related subsystems. Google limited detailed disclosure until patch adoption increases and urged users to update promptly; reported bug bounty awards for individual findings reached **up to $33,000**. The Canadian Centre for Cyber Security echoed Google’s advisory, recommending organizations apply the Chrome updates when available to remediate the affected versions. Separate Canadian Centre advisories also covered unrelated patch guidance for **Drupal contributed modules** (including a **critical access bypass** in *AJAX Dashboard* and moderate issues such as XSS in other modules) and a **Tenable Nessus Manager** vulnerability fixed in versions **10.10.3** and **10.11.3**; these items are distinct from the Chrome emergency update and should be tracked independently in vulnerability management workflows.
Jun 29, 2026