Google Chrome Updates

[harlan4096]

The security updates are posted:

This update includes 79 security fixes. Below, we highlight fixes that were contributed by external researchers.

[$43000]493310462 Critical CVE-2026-8509: Heap buffer overflow in WebML. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-17
[$25000]502636904 Critical CVE-2026-8510: Integer overflow in Skia. Reported by q@calif.io on 2026-04-14
[N/A]495108488 Critical CVE-2026-8511: Use after free in UI. Reported by Google on 2026-03-22
[N/A]495782021 Critical CVE-2026-8512: Use after free in FileSystem. Reported by Google on 2026-03-24
[N/A]495939973 Critical CVE-2026-8513: Use after free in Input. Reported by Google on 2026-03-25
[N/A]495948109 Critical CVE-2026-8514: Use after free in Aura. Reported by Google on 2026-03-25
[N/A]495999127 Critical CVE-2026-8515: Use after free in HID. Reported by Google on 2026-03-25
[N/A]496393078 Critical CVE-2026-8516: Insufficient validation of untrusted input in DataTransfer. Reported by Google on 2026-03-26
[N/A]497531263 Critical CVE-2026-8517: Object lifecycle issue in WebShare. Reported by Google on 2026-03-29
[N/A]497830330 Critical CVE-2026-8518: Use after free in Blink. Reported by Google on 2026-03-30
[N/A]498400132 Critical CVE-2026-8519: Integer overflow in ANGLE. Reported by Google on 2026-04-01
[N/A]503619813 Critical CVE-2026-8520: Race in Payments. Reported by Google on 2026-04-17
[N/A]504106200 Critical CVE-2026-8521: Use after free in Tab Groups. Reported by Google on 2026-04-18
[N/A]504185107 Critical CVE-2026-8522: Use after free in Downloads. Reported by Google on 2026-04-19
[$25000]483956252 High CVE-2026-8523: Use after free in Mojo. Reported by Paul Seekamp / nullenc0de on 2026-02-12
[$10000]503425922 High CVE-2026-8558: Out of bounds write in Fonts. Reported by Matej Smycka on 2026-04-16
[$7000]499565267 High CVE-2026-8524: Out of bounds write in WebAudio. Reported by Brendan Dolan-Gavitt, XBOW on 2026-04-06
[$2000]497928952 High CVE-2026-8525: Heap buffer overflow in ANGLE. Reported by Nathaniel Oh (@calysteon) on 2026-03-30
[TBD]486536241 High CVE-2026-8526: Out of bounds write in WebRTC. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-22
[TBD]486761172 High CVE-2026-8527: Insufficient validation of untrusted input in Downloads. Reported by rachmat.abdul.ro on 2026-02-23
[N/A]487795397 High CVE-2026-8528: Insufficient validation of untrusted input in SiteIsolation. Reported by Google on 2026-02-26
[N/A]490222151 High CVE-2026-8529: Heap buffer overflow in Codecs. Reported by Google on 2026-03-06
[N/A]491930142 High CVE-2026-8530: Use after free in Network. Reported by Google on 2026-03-11
[TBD]492350403 High CVE-2026-8531: Heap buffer overflow in WebML. Reported by Syn4pse on 2026-03-13
[N/A]492812194 High CVE-2026-8532: Integer overflow in XML. Reported by Google on 2026-03-14
[N/A]495247950 High CVE-2026-8533: Use after free in Accessibility. Reported by Google on 2026-03-23
[N/A]495314407 High CVE-2026-8534: Integer overflow in GPU. Reported by Google on 2026-03-23
[N/A]495530312 High CVE-2026-8535: Out of bounds read in Media. Reported by Google on 2026-03-23
[N/A]495857582 High CVE-2026-8536: Insufficient validation of untrusted input in ReadingMode. Reported by Google on 2026-03-24
[N/A]495890000 High CVE-2026-8537: Insufficient policy enforcement in ViewTransitions. Reported by Google on 2026-03-24
[N/A]496415073 High CVE-2026-8538: Insufficient validation of untrusted input in GPU. Reported by Google on 2026-03-26
[TBD]496524586 High CVE-2026-8539: Script injection in SanitizerAPI. Reported by Jungwoo Lee (@physicube) and Wongi Lee (@_qwerty_po) on 2026-03-26
[TBD]496627235 High CVE-2026-8540: Type Confusion in V8. Reported by Google on 2026-03-26
[N/A]496645393 High CVE-2026-8541: Out of bounds read in UI. Reported by Google on 2026-03-26
[N/A]497066659 High CVE-2026-8542: Use after free in Core. Reported by Google on 2026-03-28
[N/A]497095799 High CVE-2026-8543: Out of bounds read in FileSystem. Reported by Google on 2026-03-28
[N/A]497151750 High CVE-2026-8544: Use after free in Media. Reported by Google on 2026-03-28
[N/A]497486030 High CVE-2026-8545: Object corruption in Compositing. Reported by Google on 2026-03-29
[N/A]497531791 High CVE-2026-8546: Out of bounds read in GPU. Reported by Google on 2026-03-29
[N/A]497632199 High CVE-2026-8547: Insufficient policy enforcement in Passwords. Reported by Google on 2026-03-30
[N/A]497821764 High CVE-2026-8548: Out of bounds write in Media. Reported by Google on 2026-03-30
[N/A]497985088 High CVE-2026-8549: Use after free in Media. Reported by Google on 2026-03-31
[N/A]498322453 High CVE-2026-8550: Use after free in Google Lens. Reported by Google on 2026-03-31
[N/A]498376171 High CVE-2026-8551: Use after free in Downloads. Reported by Google on 2026-04-01
[N/A]498706958 High CVE-2026-8552: Heap buffer overflow in GPU. Reported by Google on 2026-04-01
[N/A]498715368 High CVE-2026-8553: Use after free in GPU. Reported by Google on 2026-04-01
[N/A]499131214 High CVE-2026-8554: Type Confusion in ANGLE. Reported by Google on 2026-04-03
[N/A]500033878 High CVE-2026-8555: Use after free in GTK. Reported by Google on 2026-04-06
[N/A]500052361 High CVE-2026-8556: Inappropriate implementation in ANGLE. Reported by Google on 2026-04-06
[N/A]502978647 High CVE-2026-8557: Use after free in Accessibility. Reported by Google on 2026-04-15
[N/A]504629701 High CVE-2026-8559: Integer overflow in Internationalization. Reported by Google on 2026-04-20
[TBD]328109821 Medium CVE-2026-8560: Heap buffer overflow in SwiftShader. Reported by Cassidy Kim(@cassidy6564) on 2024-03-05
[TBD]343352552 Medium CVE-2026-8561: Incorrect security UI in Fullscreen. Reported by Wolfgang Ettlinger (aff. Certitude Consulting GmbH) Alexander Hurbean (aff. Certitude Consulting GmbH) on 2024-05-29
[N/A]40057534 Medium CVE-2026-8562: Side-channel information leakage in Navigation. Reported by Google on 2021-10-06
[TBD]40061220 Medium CVE-2026-8563: Insufficient policy enforcement in IFrame Sandbox. Reported by Luan Herrera (@lbherrera_) on 2022-10-04
[TBD]418273622 Medium CVE-2026-8564: Incorrect security UI in Downloads. Reported by Alesandro Ortiz Alesandro Ortiz on 2025-05-16
[TBD]442860473 Medium CVE-2026-8565: Inappropriate implementation in Downloads. Reported by Farras Givari on 2025-09-04
[TBD]470646792 Medium CVE-2026-8566: Insufficient policy enforcement in Payments. Reported by Jorian Woltjer on 2025-12-21
[TBD]484986863 Medium CVE-2026-8567: Integer overflow in ANGLE. Reported by cinzinga on 2026-02-16
[TBD]488728570 Medium CVE-2026-8568: Insufficient policy enforcement in AI. Reported by Tianyi Hu on 2026-03-01
[N/A]490229299 Medium CVE-2026-8569: Out of bounds write in Codecs. Reported by Google on 2026-03-06
[N/A]490353576 Medium CVE-2026-8570: Type Confusion in V8. Reported by Google on 2026-03-06
[TBD]491422244 Medium CVE-2026-8571: Insufficient policy enforcement in GPU. Reported by Mark Blaszczyk on 2026-03-10
[N/A]495405493 Medium CVE-2026-8572: Insufficient policy enforcement in Network. Reported by Google on 2026-03-23
[N/A]495417883 Medium CVE-2026-8573: Integer overflow in Codecs. Reported by Google on 2026-03-23
[N/A]495902113 Medium CVE-2026-8574: Use after free in Core. Reported by Google on 2026-03-24
[N/A]496217775 Medium CVE-2026-8575: Use after free in UI. Reported by Google on 2026-03-25
[N/A]496231853 Medium CVE-2026-8576: Inappropriate implementation in CORS. Reported by Google on 2026-03-25
[N/A]496302307 Medium CVE-2026-8577: Integer overflow in Fonts. Reported by Google on 2026-03-25
[N/A]496395450 Medium CVE-2026-8578: Out of bounds read in GPU. Reported by Google on 2026-03-26
[N/A]496526419 Medium CVE-2026-8579: Insufficient validation of untrusted input in Skia. Reported by Google on 2026-03-26
[N/A]496639647 Medium CVE-2026-8580: Use after free in Mojo. Reported by Google on 2026-03-26
[N/A]497292072 Medium CVE-2026-8581: Use after free in GPU. Reported by Google on 2026-03-28
[N/A]497594413 Medium CVE-2026-8582: Object lifecycle issue in Dawn. Reported by Google on 2026-03-30
[N/A]497975477 Medium CVE-2026-8583: Insufficient policy enforcement in WebXR. Reported by Google on 2026-03-31
[N/A]498892595 Medium CVE-2026-8584: Inappropriate implementation in Views. Reported by Google on 2026-04-02
[N/A]499052720 Medium CVE-2026-8585: Inappropriate implementation in Media. Reported by Google on 2026-04-02
[N/A]499154022 Medium CVE-2026-8586: Inappropriate implementation in Chromoting. Reported by Google on 2026-04-03
[TBD]507356235 Medium CVE-2026-8587: Use after free in Extensions. Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab on 2026-04-28

Stable Channel Update for Desktop