Chrome 150 Update Fixes Out-of-Bounds Write Bug in Codecs That Could Lead to Sandbox Escape

Google released Chrome 150 to the Stable channel on July 23, 2026, closing a high-severity memory corruption vulnerability in the browser’s codec processing that could potentially let an attacker escape Chrome’s sandbox. The flaw, tracked as CVE-2026-16807, earned an 8.8 out of 10 score on the CVSS 3.1 scale and affects all desktop editions of Chrome prior to version 150.0.7871.186. Windows users, whether at home or in the office, should treat this update as a priority.

What the Chrome 150 Update Fixes

CVE-2026-16807 is an out-of-bounds write, a class of memory safety bug that occurs when software writes data outside the allocated buffer. According to the vulnerability advisory, the issue resides in Chrome’s Codecs component—the engine that decodes audio and video streams for playback on web pages. A remote attacker who crafts a malicious HTML page could, if other conditions are met, use this weakness to break out of Chrome’s heavily fortified sandbox and gain broader access to the underlying Windows system.

The patched versions for desktop are:

Because Chrome’s rollout is staged, not every installation will receive the update at the exact same moment. But the version number is the ultimate test: open Chrome, navigate to Help > About Google Chrome, and you’ll either see the patched build or a prompt to relaunch after an automatic download.

Why a Codec Bug Can Break the Browser’s Defenses

Media codecs are an attractive target for attackers because they parse complex, attacker-controllable data from the web. Every video, audio clip, or streaming source your browser encounters must be decoded in real time, often using highly optimized C/C++ code. One misplaced length check or offset calculation can create an out-of-bounds write, exactly the kind of flaw reported in CVE-2026-16807.

In Chrome, this processing occurs inside sandboxed processes designed to limit damage. The sandbox prevents a compromised renderer from freely reading your files, installing software, or altering system settings. But a sandbox escape, which is what this bug “potentially” enables, changes the calculus entirely. As first noted in the Common Vulnerabilities and Exposures (CVE) record, a successful chain that first compromises a renderer and then leverages this codec flaw could give an attacker the same powers as the logged-in user—access to documents, saved passwords, and the ability to launch further attacks.

Google has rated the Chromium security severity as High, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) assigned the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. In plain English: the vulnerability can be triggered over the network, requires no authentication, and—crucially—needs user interaction, meaning a victim must visit a booby-trapped page. But once exploited, the impact on confidentiality, integrity, and availability is rated “high” across the board.

The User Interaction Factor Doesn’t Make This a Low-Risk Flaw

Security bulletins often list “user interaction required,” leading some to dismiss the bug as trivial. In this case, though, the pathway for exploitation is frighteningly ordinary: clicking a link in an email, tapping on an ad, or merely loading a compromised website could be enough to trigger the codec vulnerability. Attackers regularly use social engineering, malvertising, and compromised legitimate sites to steer victims to exploit pages.

What’s more, sandbox escapes rarely operate alone. They are the second half of an exploit chain, the key that turns a minor browser compromise into a full-system takeover. As the security community well knows, pairing a memory corruption bug with a sandbox escape is the holy grail for sophisticated threat actors.

While current data suggests no active exploitation (CISA’s SSVC entry lists “exploitation:none”), history shows that patch diffing—comparing the fixed code to the vulnerable version—often arms attackers with enough information to craft a working exploit within days or weeks.

You Get More Than Just the Codec Fix

The Chrome 150 release is not a one-bug show. It also resolves three additional high-severity vulnerabilities:

• CVE-2026-16806: use-after-free in WebMCP
• CVE-2026-16805: use-after-free in Blink
• CVE-2026-16804: use-after-free in Input

All three are use-after-free bugs, a similarly dangerous class of memory corruption that can lead to arbitrary code execution. Because these flaws exist in different subsystems—Blink, input handling, and WebMCP—a single update slams the door on four separate avenues of attack. For IT teams, that’s a strong argument for fast-tracking deployment: one update, four critical patches.

How to Update Google Chrome on Windows Right Now

1. Open Chrome.
2. Click the three-dot menu in the top-right corner.
3. Go to Help > About Google Chrome.
4. Chrome will automatically check for updates. If an update is available, it will begin downloading.
5. Once downloaded, you’ll see a “Relaunch” button. Click it—but save your work first, because all windows will close.
6. After restart, return to the About page to confirm the version string is 150.0.7871.186 or higher (Windows may show the .187 build).

Don’t ignore the relaunch prompt for days. Until Chrome restarts, the old vulnerable processes remain in memory, leaving your system exposed. If you’ve been putting off a restart, now is the time.

For IT Administrators: Don’t Stop at One Machine

In enterprise environments, verifying that one machine is patched isn’t enough. Chrome’s automatic update mechanism can be delayed by Group Policy, network restrictions, or simply because a device is rarely restarted. Administrators should:

• Use their endpoint management console to check Chrome version distribution across all managed Windows devices.
• Force a manual update or push the latest MSI installer to lagging systems.
• Enforce a reboot or browser restart to ensure in-use processes are replaced.
• Pay extra attention to high-risk users: executives, finance staff, IT administrators, and anyone who browses the public web extensively.

Because this fix also covers three other high-severity flaws, the risk of inaction is compounded. Even if you believe your perfect security awareness training will keep users from clicking malicious links, a single exposed device can serve as a beachhead.

What About Microsoft Edge and Other Chromium-Based Browsers?

CVE-2026-16807 originates in the Chromium project, which underpins not only Chrome but also Microsoft Edge, Brave, Opera, Vivaldi, and many other browsers. However, a fix in Chrome does not automatically mean those browsers are safe. Each vendor maintains its own release pipeline and may backport security patches at a different pace.

• Microsoft Edge: The security team typically integrates Chromium patches quickly, but you should verify the latest Edge version via its Help and Feedback > About Microsoft Edge path, or through Windows Update if your organization manages Edge updates centrally.
• Other Chromium browsers: Check the vendor’s security advisories and release notes. Do not assume that “Chrome is updated” covers everything on your machine.

For Windows environments with multiple Chromium-based browsers, treat each as a separate patching target.

Practical Security Habits That Go Beyond This Patch

While updating Chrome immediately is the critical task, it’s also an opportunity to refresh good security hygiene:

• Keep all browsers on current builds and set them to auto-update if possible.
• Remove or audit browser extensions periodically; they introduce their own attack surface.
• Use a password manager to generate and store unique credentials, reducing the blast radius if a site is compromised.
• Enable multi-factor authentication on any account that supports it, especially email and cloud services.
• Run as a standard user, not administrator, for day-to-day work. This limits what a sandbox escape can achieve.
• Stay current with Windows security patches; operating system mitigations make exploitation harder even if a browser flaw is triggered.

For businesses, browser security isn’t a “set and forget” item. Continuous monitoring, version reporting, and unambiguous patching SLAs are now baseline expectations, not advanced practices.

What to Watch Next

The NVD entry for CVE-2026-16807 is still “undergoing enrichment,” meaning additional technical details—such as the affected CPEs, CWE refinements, or a final CVSS 4.0 score—may appear in the coming days. Security researchers often publish proof-of-concept code after patches are widely deployed, so expect deeper technical breakdowns soon. Meanwhile, keep an eye on the Chromium release blog for any off-cycle updates or regressions.

The most important action, though, is already in your hands: ensure every Windows device you’re responsible for is running Chrome 150.0.7871.186 or later. Out-of-bounds write vulnerabilities don’t respect calendars, and sandboxes are only as strong as the code that upholds them.