CERT-In Vulnerability Note
CIVN-2026-0298
Multiple Vulnerabilities in Google Chrome for Desktop
Original Issue Date:June 10, 2026
Severity Rating: CRITICAL
Software Affected
- Google Chrome version prior to 149.0.7827.53/54 for Windows and Mac
- Google Chrome version prior to 149.0.7827.53 for Linux.
For complete list of affected products refer to the Chrome advisory:
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html
Overview
Multiple vulnerabilities have been reported in Google Chrome which could allow a remote attacker to execute arbitrary code, obtain sensitive information, bypass security restriction, or cause Denial-of-Service (DoS) condition on the targeted system.
Target Audience:
All end-user organizations and individuals using Google Chrome for Desktop.
Risk Assessment:
High risk of remote code execution, unauthorized access to sensitive data, disruption of services, privilege escalation.
Impact Assessment:
Potential for system compromise, sensitive information disclosure, service disruption.
Description
Google Chrome is a popular internet browser used for accessing information on the World Wide Web. It is designed for use on desktop systems including Windows, macOS and Linux.
Multiple vulnerabilities exist in Google Chrome due to Out-of-Bounds read and write, use-after-free (UAF), Heap and Stack Buffer Overflow, Inappropriate implementation, Type Confusion, Insufficient validation of untrusted input, Integer overflow, Script injection, Insufficient policy enforcement, Uninitialized Use, Policy bypass, Object lifecycle issue, Side-channel information leakage, Incorrect security UI and Race issues across multiple components including ANGLE, V8, GPU, Chromecast, Network, WebRTC, FileSystem, Password Manager, Ozone, GFX, Chromoting, Cast Streaming and more. A remote attacker could exploit these vulnerabilities by convincing a victim to open a specially crafted web request.
Successful exploitation of these vulnerabilities could allow a remote attacker to execute arbitrary code, obtain sensitive information, bypass security restriction, or cause Denial-of-Service (DoS) condition on the targeted system.
Solution
Apply appropriate updates as mentioned by the vendor:
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html
Vendor Information
Google Chrome
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html
References
Google Chrome
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-22902657
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|