Update Chrome to patch critical browser security flaws

1. Executive summary

Google released Chrome 149.0.7827.196/197 (Windows/Mac) and 149.0.7827.196 (Linux), patching 18 vulnerabilities including four rated Critical. Two of those Critical flaws — CVE-2026-13028 (CVSS 9.6 CRITICAL, CWE-416 Use After Free) and CVE-2026-13032 (CVSS unknown) — are use-after-free bugs in WebGL that enable sandbox escape via a crafted HTML page. Neither CVE is currently listed in CISA KEV, and Google reports no active in-the-wild exploitation of any of the 18 patched bugs. For EMEA financial services, the primary risk is a drive-by compromise chain: a user visiting a malicious or compromised web page could trigger the WebGL UAF, escape the sandbox, and achieve code execution on the endpoint. The risk is elevated by the historical context that CVE-2026-2441 (CVSS 8.8 HIGH, IN CISA KEV since 2026-02-17, CWE-416) — a separate use-after-free in CSS patched earlier this year — could have been chained with either WebGL flaw to achieve full system compromise.

2. Regulatory framing

3. Technical analysis & attack chain

Patched versions

• Windows/Mac: Chrome 149.0.7827.196/197
• Linux: Chrome 149.0.7827.196
• Android: Chrome 149.0.7827.197

The update rolls out automatically over days/weeks. Manual update path: More menu (three dots) → Settings → About Chrome → restart.

Vulnerabilities in scope

CVE-2026-13028 — CVSS 9.6 CRITICAL — NOT in CISA KEV — CWE-416 (Use After Free). Discovered by an external researcher (not Google). Use-after-free in WebGL. A crafted HTML page can trigger the UAF, enabling the attacker to escape Chrome's browser sandbox. The sandbox is designed to contain malicious activity within the browser process; a sandbox escape breaks that containment, allowing code execution in the context of the wider system.

CVE-2026-13032 — CVSS unknown — NOT in CISA KEV. Also a use-after-free in WebGL. Same attack vector: a remote attacker can escape the sandbox via a crafted HTML page. No CVSS score is available in the verified reference data; treat severity as unconfirmed beyond the "Critical" rating in the source.

CVE-2026-2441 — CVSS 8.8 HIGH — IN CISA KEV (added 2026-02-17) — EPSS 22% — CWE-416 (Use After Free). A separate, earlier-patched use-after-free in CSS. Allowed attackers to run code inside Chrome's sandbox through a malicious web page. Not part of this Chrome 149.0.7827.196 update — it was patched in a prior release — but the source explicitly describes it as a potential chain component.

Attack chain (theoretical — no confirmed in-the-wild exploitation)

1. Initial access: User navigates to (or is redirected to) a malicious or compromised web page hosting crafted HTML/WebGL content.
2. Trigger: The crafted page invokes WebGL in a manner that triggers the use-after-free condition (CVE-2026-13028 or CVE-2026-13032) in the browser's graphics pipeline.
3. Sandbox escape: The UAF is exploited to corrupt memory and gain control of execution outside the browser sandbox, moving from browser-process context to the wider system.
4. Optional chain with CVE-2026-2441: If the attacker also leveraged CVE-2026-2441 (code execution inside the sandbox via CSS UAF), the combined chain would provide both the in-sandbox foothold and the sandbox-escape primitive, potentially yielding full system compromise. This chain is described in the source as a hypothetical scenario, not a confirmed exploit chain.

Unconfirmed / single-sourced claims

• No active exploitation: Google states none of the 18 newly patched bugs are being exploited in the wild. This is single-sourced (Google's advisory via Malwarebytes). No independent corroboration in the provided sources.
• Four Critical vulnerabilities: The source states four of the 18 are rated Critical, but only two (CVE-2026-13028, CVE-2026-13032) are described with technical detail. The other two Critical CVEs are not named in the source material.
• CVE-2026-13032 CVSS: No CVSS score is available in the verified reference data. Do not assume a score.

Historical context (corroborated across multiple sources)

Chrome has had at least five actively exploited zero-days in 2026: CVE-2026-2441 (January), CVE-2026-3909 and CVE-2026-3910 (March), CVE-2026-5281 (April), and CVE-2026-11645 (June — V8 out-of-bounds read/write, CVSS not in verified data, patched in 149.0.7827.102/.103). This pattern confirms sustained attacker investment in Chrome exploit development. The current 18-bug update is distinct from the CVE-2026-11645 patch.

4. Mitigation & containment

P1 — Within 24 hours

• Force Chrome update on managed endpoints: Push Chrome 149.0.7827.196 (Windows/Mac/Linux) via MDM/Group Policy/endpoint management. Do not wait for automatic rollout.
• Group Policy path: Computer Configuration > Administrative Templates > Google > Google Chrome > Update > AutoUpdateCheckPeriodMinutes — set to a short interval (e.g., 15 minutes) to force prompt update checks.
• Verify post-update: navigate to chrome://version and confirm version string starts with 149.0.7827.196 or higher.
• Identify stale Chrome instances: Query endpoint inventory for Chrome versions below 149.0.7827.196. Flag any systems where the browser has not been restarted (update staged but not applied — the relaunch is required).

P2 — Within 72 hours

• Block WebGL on high-risk endpoints where patching is delayed: If a subset of endpoints cannot be updated immediately, consider disabling WebGL via policy:
• Group Policy: Administrative Templates > Google > Google Chrome > Content Settings > DefaultWebGlSetting — set to 2 (Do not allow sites to run WebGL).
• Note: This will break 3D/interactive graphics on affected sites; assess business impact before applying broadly.
• EDR / network monitoring: Monitor for suspicious child processes spawned by chrome.exe / chrome (Linux/Mac), which would indicate a sandbox escape. Alert on chrome.exe spawning cmd.exe, powershell.exe, /bin/sh, or unexpected script interpreters.
• Web content filtering: Ensure web gateway/proxy blocks known malicious domains. The attack vector is a crafted HTML page — content filtering is a compensating control.

P3 — Within 7 days

• Patch validation: Test Chrome 149.0.7827.196 against internal financial applications (especially any using WebGL or Canvas) before broad deployment to avoid operational disruption.
• Update Chrome for Android: Ensure mobile device management pushes Chrome 149.0.7827.197 to managed Android endpoints.
• Review browser extension policies: The source notes extensions can prevent Chrome updates. Audit extension policies and remove or block extensions that interfere with the update mechanism.
• Hunt for prior exploitation: Search endpoint telemetry for indicators of WebGL-based exploitation attempts (crash dumps in Chrome's WebGL/GPU process, unexpected chrome --gpu-launcher crashes). No specific IOCs are available from the source, so this is behavioural hunting only.

5. Indicators of compromise

No indicators of compromise available in the source material.

6. Detection

The sources do not provide file hashes, mutex names, registry keys, command-line flags, or hard-coded strings associated with exploitation of these CVEs. However, the sources do identify specific process names and the behavioural pattern of a sandbox escape (browser process spawning unexpected child processes). A Sigma rule for that behavioural indicator is provided below.

title: Chrome Sandbox Escape - Suspicious Child Process
id: adtrace-chrome-sandbox-escape-2026-06-25
status: experimental
description: Detects Chrome browser process spawning unexpected child processes, consistent with a sandbox escape via CVE-2026-13028 or CVE-2026-13032
author: Adverse Trace
date: 2026/06/25
references:

  - https://www.malwarebytes.com/blog/news/2026/06/update-chrome-to-patch-critical-browser-security-flaws
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith:

      - \chrome.exe
    Image|endswith:

      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
      - \wscript.exe
      - \cscript.exe
      - \mshta.exe
      - \rundll32.exe
      - \regsvr32.exe
  condition: selection
falsepositives:

  - Legitimate browser extensions or applications that spawn child processes from Chrome
  - Chrome enterprise policies that intentionally launch helper processes
level: high

CVE assessment

3 referenced CVEs — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• Malwarebytes — "Update Chrome to patch critical browser security flaws" — https://www.malwarebytes.com/blog/news/2026/06/update-chrome-to-patch-critical-browser-security-flaws — 2026-06-25
• Malwarebytes Labs — "Update Chrome: Google patches actively exploited vulnerability and 73 others" — https://www.malwarebytes.com/blog/bugs/2026/06/update-chrome-google-patches-actively-exploited-vulnerability-and-73-others — 2026-06
• SecurityWeek — "Chrome 149 Update Resolves 18 Severe Vulnerabilities" — https://www.securityweek.com/chrome-149-update-resolves-18-severe-vulnerabilities/ — 2026-06
• Help Net Security — "Google patches Chrome zero-day exploited in the wild (CVE-2026-11645)" — https://www.helpnetsecurity.com/2026/06/09/google-chrome-zero-day-cve-2026-11645/ — 2026-06-09
• SecurityWeek — "Google Patches 5th Chrome Zero-Day Exploited in 2026" — https://www.securityweek.com/google-patches-5th-chrome-zero-day-exploited-in-2026/ — 2026-06
• SecurityWeek — "Chrome 149 Patches 429 Vulnerabilities" — https://www.securityweek.com/chrome-149-patches-429-vulnerabilities/ — 2026
• The Register — "Chrome's zero-day Whac-A-Mole continues with fifth exploited bug of the year" — https://www.theregister.com/security/2026/06/09/chromes-zero-day-whac-a-mole-continues-with-fifth-exploited-bug-of-the-year/5252689 — 2026-06-09

8. Adverse Trace position

Severity assessment: CVE-2026-13028 is CVSS 9.6 CRITICAL (verified) and represents a sandbox-escape primitive via a single crafted web page — this is a high-severity finding regardless of the absence of confirmed exploitation. CVE-2026-13032 lacks a CVSS score in verified data but is rated Critical in the source; treat as Critical but flag the missing score. CVE-2026-2441 (CVSS 8.8 HIGH, CISA KEV) is a confirmed, separately patched chain component. The combination of a sandbox-escape WebGL UAF with an in-sandbox code-execution primitive (CVE-2026-2441) represents a credible full-system compromise chain. Client-impact assessment: All EMEA financial services clients running Chrome below 149.0.7827.196 are exposed. The attack vector (drive-by via crafted HTML) requires only that a user visits a malicious page — no user interaction beyond navigation is needed. Prior patching of CVE-2026-2441 (in CISA KEV) reduces the chain risk, but the WebGL sandbox-escape alone remains a Critical-severity issue. What we will do next: Monitor for any indication of in-the-wild exploitation of CVE-2026-13028 or CVE-2026-13032; if exploitation is confirmed, we will escalate this advisory to and issue IOCs as they become available. We will also track whether CISA adds either CVE to KEV. Attribution is not applicable to this item — no threat actor is named in the source material.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.