Multiple Google Chrome CVEs Enable Remote Code Execution

Affected Environment
Chrome installations on Windows, macOS and Linux running versions earlier than 147.0.7727.137/138 are exposed to multiple CVEs. Exposure applies wherever Chrome is used for user browsing or remote access functions within the organisation.

Threat Overview
Multiple high‑severity Chrome flaws can enable remote code execution in the browser and possible sandbox escape by an external attacker. A successful attack could provide full system compromise and support lateral movement from the initially affected endpoint.

Exposure Timeline
Google released the fixed desktop versions on 28 April 2026; this alert was issued 29–30 April 2026. At publication time, there are no reports of in‑the‑wild exploitation, but exposure persists until updates are applied.

Attack Surface
Any user browsing session in an unpatched Chrome instance can be a trigger point via crafted web content or media. Features such as WebRTC, media, GPU, Canvas, WebView, Cast, and remote access components widen the potential attack surface.

Technical Root Cause
Most CVEs arise from memory safety issues, including use‑after‑free, heap buffer overflows, and out‑of‑bounds read/write in Chrome components. Additional flaws include insufficient input validation, integer overflow, type confusion, and race conditions in supporting libraries.

Exploitation Pathway
An attacker could lure a user to malicious content that exercises one of the memory or validation flaws in the Chrome process. If combined with sandbox escape, this could allow code execution on the host, followed by credential access and lateral movement.