Chrome 146 Emergency Update: 8 High-Severity Vulnerabilities That Could Compromise Your Browser

Google just released an urgent Chrome update patching eight high-severity vulnerabilities — all capable of enabling remote code execution, targeting GPU, audio, fonts, and federated auth components.

Google just released an urgent Chrome update patching eight high-severity vulnerabilities — all capable of enabling remote code execution. Chrome 146.0.7680.164/.165 for Windows and macOS, and 146.0.7680.164 for Linux, addresses a wave of memory corruption bugs spanning multiple browser components.

Here's what security teams and developers need to know.

The Eight Vulnerabilities

Why This Update Matters

Three Use-After-Free Vulnerabilities in One Patch

Use-after-free (UAF) bugs are among the most dangerous browser vulnerabilities. They occur when a program accesses memory after it's been freed, allowing attackers to control what happens next. Three separate components — Dawn, WebGPU, and FedCM — all had UAF flaws in the same release cycle.

Dawn and WebGPU are closely related (Dawn is Chrome's WebGPU implementation), meaning two of these UAFs target the same GPU processing pipeline. For attackers, this represents multiple entry points into the same high-privilege subsystem.

GPU Components Under Fire

Four of the eight vulnerabilities (CVE-2026-4673, CVE-2026-4675, CVE-2026-4676, CVE-2026-4678) target graphics and audio processing — components that often run with elevated privileges for performance reasons. GPU-related vulnerabilities are particularly concerning because:

• GPU processes handle untrusted content from any website
• Buffer overflows in GPU code can bypass sandboxing protections
• WebGPU's compute capabilities expand the attack surface beyond traditional rendering

The FedCM Angle

CVE-2026-4680 stands out from the pack. FedCM (Federated Credential Management) handles authentication flows — the "Sign in with Google/GitHub/etc." prompts. A use-after-free in FedCM could potentially allow attackers to hijack authentication sessions or intercept credential exchanges, making this vulnerability relevant for anyone using federated login on Chrome.

Font Rendering Still a Target

CVE-2026-4679, an integer overflow in Chrome's Fonts component, continues a long tradition of font-based attacks. Maliciously crafted font files have been a reliable attack vector for decades — from the WMF exploits of the 2000s to modern OpenType fuzzing. Font parsing runs early in the rendering pipeline, making it an attractive target for initial code execution.

Who's Affected

Everyone running Chrome, Edge, Brave, Opera, or any Chromium-based browser. This isn't just a Chrome problem — every browser built on Chromium shares these components.

Beyond desktop browsers, consider:

• Electron apps: Slack, VS Code, Discord, and hundreds of other desktop apps embed Chromium
• Headless Chrome: CI/CD pipelines running Puppeteer or Playwright
• WebView: Mobile apps using Chrome's rendering engine
• Enterprise kiosks: Public-facing terminals running Chrome

What to Do Right Now

Individual Users

Open Chrome → Menu → Help → About Google Chrome. Let it update and restart.

Enterprise Administrators

1. Push Chrome 146.0.7680.164/.165 through your patch management system immediately
2. Audit Electron app versions across your environment — they may bundle older Chromium
3. Update headless Chrome instances in your CI/CD infrastructure
4. Check Chrome version policies to ensure auto-update isn't blocked

Developers

1. Update any pinned Chromium versions in your build systems
2. If you maintain an Electron app, track upstream Chromium patches
3. Review WebGPU and WebAudio usage in your applications for potential exposure

The Bigger Picture

Eight high-severity vulnerabilities in a single Chrome update isn't unprecedented, but the concentration across GPU and authentication components is notable. Google's security team — using tools like AddressSanitizer, MemorySanitizer, and libFuzzer — caught these before active exploitation was reported.

Google has confirmed at least $7,000 in bug bounties for the WebAudio vulnerability, with several other reward amounts still pending. The fact that Google restricts technical details until most users have updated tells you everything about the exploitability of these flaws.

Bottom line: Update Chrome now. Audit your Chromium-dependent infrastructure. Don't wait for the weekend.

Track Chrome vulnerabilities and get instant alerts when new CVEs affect your browser stack with VulnTracker. Set up product-level monitoring so you never miss a critical update again.