Google Chrome 149 Fixes a Record-Breaking 429 Vulnerabilities — Update Now

Google Chrome 149 Fixes a Record-Breaking 429 Vulnerabilities — Update Now

Google released Chrome 149 to the stable channel on June 2, 2026, patching 429 security vulnerabilities — the largest number ever addressed in a single Chrome update. Users across all desktop platforms are strongly advised to update immediately.

The sheer scale of this release is unprecedented. Chrome 149 surpasses the total count of all Chrome security fixes released in the entirety of 2025, in a single version bump. Security researchers and analysts attribute this surge partly to the increased use of AI-powered fuzzing tools, which have become significantly more effective at uncovering memory safety issues deep within the browser’s graphics, JavaScript, and networking subsystems.

No active exploitation of any of these vulnerabilities has been reported at the time of publication. However, with 22 Critical-rated flaws among the 429, the risk window between public disclosure and attempted exploitation is narrow — prompt updating is essential.

Critical Vulnerabilities (22 total)

The most severe flaw — CVE-2026-10881, rated CVSS 9.6 — is an out-of-bounds read and write in the ANGLE graphics engine. A remote attacker could exploit it via a crafted HTML page to escape Chrome’s sandbox and potentially execute arbitrary code on the host system. Google awarded the external researcher who reported it a $97,000 bug bounty. All 22 Critical vulnerabilities are listed below.

What Makes This Release Unusual

The 429-vulnerability count is not the result of a single security incident but rather reflects a sustained acceleration in Chrome’s internal bug discovery program. Google has been applying AI-assisted fuzzing extensively to its codebase, and the results are showing up in release notes at an unprecedented scale. Out of the 22 Critical flaws, only three were reported by external researchers; the remaining 19 were found internally. Among roughly 90 High-severity bugs, only 10 came from outside researchers, with the bulk of medium and low findings also originating from Google’s own tooling.

The top external bounty awarded in this release was $97,000 for CVE-2026-10881, reflecting both the severity of the ANGLE out-of-bounds flaw and Chrome’s continued investment in its bug bounty program.

Affected Versions and Available Updates

Chrome is available free of charge from Google’s website for Windows, macOS, and Linux. Any installed version prior to those listed above is potentially vulnerable to all 429 flaws addressed in this release.

How to Update Chrome Now

Chrome updates automatically in the background when a new version is available, but the update does not take effect until the browser is restarted. Users who leave Chrome running for extended periods may be on a vulnerable version even after the update has been downloaded. Restarting Chrome ensures the fix is applied.