Google Chrome Fixes 83 Security Flaws, Including 5 Critical Ones that Could Enable RCE Attacks

Google released a Chrome security update that addresses 83 vulnerabilities, including five critical use-after-free flaws that could allow remote code execution.

According to the supplied release notice, the update covers Windows, macOS, and Linux, with fixes spanning browser rendering, graphics, JavaScript processing, and other core features.

The Stable channel moves to version 157.0.8103.78/.79 for Windows and Mac, while Linux receives 157.0.8103.78. Google says the release will reach users over the coming days and weeks.

The notice lists five critical vulnerabilities and 78 high-severity issues, making this an important update for personal devices and managed business systems. All five critical vulnerabilities involve use-after-free errors. These occur when software continues accessing memory after releasing it.

If attackers can control how that memory is reused, they may cause crashes, corrupt data, or potentially execute malicious code. Similar risks appeared in an earlier Chrome update that fixed 52 security flaws and also addressed memory safety bugs.

The critical issues are CVE-2026-126885 in ServiceWorker, CVE-2026-126895 in CSS, CVE-2026-126879 in Layout, CVE-2026-126846 in Skia, and CVE-2026-126911 in Accessibility. These components support background web tasks, page styling, page layout, graphics, and accessibility features.

Chrome Fixes 83 Security Flaws

Xinyang Ge reported the ServiceWorker, CSS, and Layout vulnerabilities on October 2, October 19, and October 22, respectively. Google reported the Skia issue on November 2, while Andrew Boni reported the Accessibility flaw that same day. The reward for Boni’s finding remains pending in the supplied notice.

Although these weaknesses raise concerns about remote code execution, the notice does not describe working exploits or establish that each flaw enables full device compromise. It also does not state that these newly listed vulnerabilities are being exploited in the wild.

The remaining fixes address a broad range of weaknesses, including type confusion, buffer overflows, out-of-bounds memory access, information leaks, and missing authorization checks. Affected components include V8, ANGLE, Skia, Extensions, FileSystem, MediaStream, PDF, and SiteIsolation.

Several reports credit Anthropic researchers assisted by Claude and OpenAI Codex Security. These acknowledgments show AI-assisted research contributing to this release. However, the notice does not explain how those tools identified or validated individual findings.

This update follows a separate Chrome zero-day patch for an actively exploited XML vulnerability. That earlier exploitation report should not be confused with evidence of attacks against the 83 vulnerabilities covered here.

Users should open Chrome’s menu, select Help, then About Google Chrome to check for updates. Relaunch the browser when prompted so the new version takes effect. Administrators should verify deployment across managed devices rather than assume every installation has updated automatically.

Google may restrict technical bug details until enough users receive fixes or affected third-party projects finish patching. The Chromium Security page explains its disclosure process and provides further guidance on vulnerability reporting and browser security.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs

The post Google Chrome Fixes 83 Security Flaws, Including 5 Critical Ones that Could Enable RCE Attacks appeared first on Cyber Security News.