{“lastseen”:”2026-05-22T14:05:38″,”description”:”Google has issued updates for the Chrome browser patching a number of high\u2011severity vulnerabilities. \\n\\nThe update includes fixes for two critical vulnerabilities that can be used for remote code execution just by visiting a malicious website.\\n\\nThe stable channel has been updated to 148.0.7778.178\/179 for Windows\/Mac and 148.0.7778.178 for Linux, which will roll out over the coming weeks.\\n\\n## How to update Chrome\\n\\nIf you don\u2019t want to wait for the rollout to reach you, manually updating is easy.\\n\\nThe easiest way to update is to allow Chrome to update automatically. But you can end up lagging behind if you never close your browser or if something goes wrong, such as an extension preventing the update.\\n\\nTo update manually, click the **More** menu (three dots), then go to **Settings** \\u003e **About Chrome**. If an update is available, Chrome will start downloading it. Restart Chrome to complete the update, and you\u2019ll be protected against these vulnerabilities.\\n\\nChrome version 148.0.7778.179 is up to date\\n\\nYou can also find step-by-step instructions in our guide to how to update Chrome on every operating system.\\n\\n## Technical details\\n\\nThe update includes fixes for two critical vulnerabilities:\\n\\nCVE-2026-9111: A use-after-free vulnerability in WebRTC allowed a remote attacker to execute arbitrary code on Linux via a crafted HTML page. Use-after-free is a class of vulnerability caused by incorrect use of dynamic memory during a program\u2019s operation. If, after freeing a memory location, a program does not clear the pointer to that memory, an attacker may be able to use the error to manipulate the program.\\n\\nSo if an attacker manages to trick a Linux user into opening a malicious HTML file or visit a specially crafted website, they could compromise the device.\\n\\nCVE-2026-9110: An inappropriate implementation in the UI on Windows allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page.\\n\\nIn practice, this meant that, if an attacker had already taken control of the browser\u2019s internal rendering engine, they could trick the browser into showing you a fake window or dialog box that looked real. This fake window could, for example, make it seem like you were entering your password on a trusted site, even though you were actually giving it to the attacker.\\n\\nFor those expecting this update to include a fix for the accidentally leaked \u201cBrowser Fetch\u201d flaw this will come as a disappointment: it did not.\\n\\nFor those that haven\u2019t read about it, since its reporting 46 months ago, the \u201cBrowser Fetch\u201d vulnerability remained unknown except to Chromium developers. Then on May 20, 2026, it was published to the Chromium bug tracker. The researcher who initially reported the vulnerability assumed it had finally been fixed. Shortly afterwards, she learned that it remained unpatched. While Google removed the post, it remains available on archival sites, along with the exploit code.\\n\\n* * *\\n\\n**We don\u2019t just report on threats\u2014we remove them**\\n\\nCybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.”,”published”:”2026-05-22T12:10:36″,”modified”:”2026-05-22T12:10:36″,”type”:”malwarebytes”,”title”:”Update Chrome now: Critical bugs could let attackers run code”,”source”:””,”references”:””,”id”:”MALWAREBYTES:833B3ED3EABB5A23AC4482654BAEF024″,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[“CVE-2026-9110″,”CVE-2026-9111″],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:8.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.malwarebytes.com\/blog\/bugs\/2026\/05\/update-chrome-now-critical-bugs-could-let-attackers-run-code”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-22T14:05:38″,”description”:”Google has issued updates for the Chrome browser patching a number of high\u2011severity vulnerabilities. \\n\\nThe update includes fixes for two critical vulnerabilities that can be…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,41,12,15,115,13,7,11,5],"class_list":["post-56322","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-cvss-88","tag-exploit","tag-high","tag-malwarebytes","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n