If you received multiple prompts to restart your Google Chrome browser over the last couple of days, you aren’t alone. In a rare, rapid-fire deployment sequence, Google rolled out two critical security updates within a brief 48-hour window.
The sudden double-update addresses three high-severity and critical vulnerabilities lurking deep within Chrome’s internal plumbing—specifically affecting the CameraCapture, GPU, and Network sub-systems.
Here is what went down, what these flaws mean for your device, and how to verify you are protected.
The Underlying Threat: Understanding Use-After-Free (UAF)
All three of the major flaws fixed in this update cycle belong to a dangerous category of memory safety bugs known as use-after-free (UAF) flaws.
What is a Use-After-Free bug? When a browser opens a webpage, it constantly allocates chunks of system memory to load images, run scripts, or process data. Once a task finishes, Chrome is supposed to free up that memory. A UAF vulnerability happens when the browser frees up a segment of memory but accidentally keeps a “pointer” pointing to it. If an attacker tricks the browser into reuse-routing data to that specific address, they can inject malicious code directly into the system memory.
Because these vulnerabilities occur in highly privileged parts of the browser ecosystem, successful exploitation can result in Remote Code Execution (RCE) or allow a malicious site to break completely out of Chrome’s security sandbox.
Anatomy of the Patches
The core fixes are bundled into Chrome Stable Channel version 150.0.7871.128/.129. The security advisory outlines three primary pain points inside the browser’s core architecture:
| Vulnerability ID | Vulnerability Component | Severity Level | Why it Matters |
| CVE-2026-15899 | CameraCapture | Critical | Manages the intake of multimedia streams (like webcams and video feeds). A memory leak here allows malicious sites to target media-handling routines. |
| CVE-2026-15900 | GPU (Graphics Processing Unit) | Critical | Dictates hardware-accelerated rendering for WebGL and 2D canvas tasks. Malicious HTML canvas interactions can trigger memory corruption. |
| CVE-2026-15901 | Network Infrastructure | Critical | Oversees requests, responses, and standard web traffic streams. Because it processes incoming external data, bugs here have high external exposure. |
Google has kept the exact proof-of-concept mechanics under wraps to ensure threat actors don’t reverse-engineer the exploit before the global user base applies the fix.
How to Force the Update and Secure Your Browser
Chrome typically downloads security patches quietly in the background, but the fix is not active until the browser process restarts completely. If you have dozens of open tabs that you haven’t closed in days, you are likely still running the vulnerable version.
Follow these steps to apply the patch immediately:
The Bottom Line
While Google hasn’t detected any active zero-day exploitation of these flaws in the wild yet, the narrow window between public patch tracking and active threat research means users should act immediately. If you use other Chromium-based alternatives like Microsoft Edge, Brave, Opera, or Vivaldi, keep an eye out for downstream patches rolling out over the coming days.