Google Patches 382 Chrome Vulnerabilities, 15 Rated Critical

Google has promoted a new Chrome Stable channel release for Windows, Mac and Linux that resolves 382 security vulnerabilities. Of these, 15 are rated critical and 67 high severity, with the remainder split between 169 medium and 131 low severity issues.

The update will roll out to users over the coming days and weeks through Chrome's standard staged rollout. Google's advisory notes that access to individual bug details may stay restricted until most users have updated, a routine practice that limits the window for reverse-engineering fixes into working exploits.

According to SecurityWeek, 358 of the 382 flaws were discovered by Google itself, continuing a run in which the company has reported hundreds of Chrome flaws across recent releases.

The 15 critical-rated issues are predominantly memory-safety bugs - mostly use-after-free - alongside a type-confusion flaw and several input-validation weaknesses. Per Google's advisory, they affect the following components:

• Use-after-free: Extensions (CVE-2026-13774), GPU (CVE-2026-13775), WebUSB (CVE-2026-13778), Chromoting (CVE-2026-13779 and CVE-2026-13787), Browser (CVE-2026-13782), Views (CVE-2026-13783, CVE-2026-13784), Bluetooth (CVE-2026-13785), Ozone (CVE-2026-13786) and Fullscreen (CVE-2026-13788)
• Type confusion: Dawn (CVE-2026-13776)
• Insufficient validation of untrusted input: iOSWeb (CVE-2026-13777), ANGLE (CVE-2026-13780) and Skia (CVE-2026-13781)

More broadly, SecurityWeek describes the patched flaws as use-after-free, out-of-bounds, incorrect security UI, uninitialized use, type confusion and insufficient input validation issues. Many affect the renderer process and can typically be triggered via crafted web content, which could allow a remote attacker to achieve arbitrary code execution inside the renderer sandbox. In some cases, an attacker who has already compromised the renderer may be able to escape the sandbox and run code on the underlying system.

This release continues a pattern of unusually large Chrome patches. SecurityWeek reports that Google has discovered and fixed hundreds of Chrome flaws across recent releases, a surge the outlet says Google has linked to AI - although the company has not shared which specific AI tools are driving the increase.

Google's own advisory notes that many of its security bugs are caught during development using fuzzing and sanitizer tooling such as AddressSanitizer, MemorySanitizer and libFuzzer. The advisory also credits external security researchers, with bug-bounty rewards on this release reaching up to $36,000 for a high-severity use-after-free flaw in the GPU component (CVE-2026-13789).

Separately, and not part of this update, SecurityWeek notes that earlier in the month Google patched what it described as the fifth actively exploited Chrome zero-day of 2026.

Because 15 of the fixes are critical and several involve renderer-process code execution, IT teams should push the update across managed Chrome fleets promptly, even though no active exploitation has been reported for these specific flaws.

To apply the fix, open Chrome's Settings → About Chrome, allow the browser to fetch the latest Stable build, and relaunch - an update only takes effect after the browser restarts. In managed environments, verify that your update policies and target version enforcement are pointed at a build that includes these fixes, and confirm rollout across endpoints through your management console. Chromium-based browsers that track upstream releases should be updated once their vendors ship the corresponding version.