Google Issues Emergency Chrome Security Update to Address High-Severity PDFium and V8 Flaws

A significant security update for the Chrome Stable Channel to address multiple vulnerabilities, including high-severity flaws affecting the browser’s core engines.

The tech giant announced the rollout of versions 145.0.7632.109/110 for Windows and Mac, as well as 144.0.7559.109 for Linux.

This update is currently being distributed to the global user base. It contains three specific security fixes that mitigate potential exploitation risks.

Security teams and individual users are strongly advised to apply these patches immediately to prevent attackers from leveraging these bugs for arbitrary code execution or browser instability.

Vulnerability Details and Analysis

The most critical aspects of this update focus on memory-handling errors in PDFium and V8.

CVE ID	Severity	Description
CVE-2026-2648	High	Heap buffer overflow in PDFium
CVE-2026-2649	High	Integer overflow in V8 JavaScript engine
CVE-2026-2650	Medium	Heap buffer overflow in Media component

The first high-severity issue, tracked as CVE-2026-2648, involves a heap buffer overflow in PDFium, which is the default PDF rendering engine used by the browser.

Security researcher Soiax reported this vulnerability. Heap buffer overflows can typically lead to a crash or allow a threat actor to execute arbitrary code on the target system.

The second high-severity flaw, CVE-2026-2649, is an integer overflow vulnerability in the V8 JavaScript engine.

This issue was discovered by JunYoung Park (@candymate) of the KAIST Hacking Lab. Integer overflows in the rendering engine can often be exploited to bypass security checks or corrupt memory.

In addition to the high-severity flaws, the update addresses a medium-severity vulnerability found internally by Google. Tracked as CVE-2026-2650, this issue is a heap buffer overflow in the Media component.

In accordance with Google’s security disclosure policy, access to specific bug details and exploit demonstrations is currently restricted.

This precaution prevents threat actors from reverse-engineering the patch before a majority of active users have successfully updated their browsers.

Users can manually initiate the update process by navigating to the Chrome menu, selecting Help, and clicking on About Google Chrome.

The browser will automatically check for available updates and download the new version. To complete the installation and ensure the security patches are active, users must relaunch the browser.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.