Google Chrome users face three high-severity vulnerabilities patched in version 145.0.7632.116, released around February 22-23, 2026. These flaws, all rated High by Chromium, enable remote attackers to compromise systems via malicious web content.
Vulnerability Breakdown
CVE-2026-3061: Out-of-Bounds Read in Media
This flaw in Chrome’s Media component lets attackers read sensitive memory through crafted HTML pages. Reported by Luke Francis on February 9, 2026, it risks leaking user data or cryptographic keys without further interaction.
CVE-2026-3062: Out-of-Bounds Read/Write in Tint (Mac)
Affects the Tint component on macOS, allowing memory corruption via malicious sites. Disclosed by cinzinga on February 11, 2026, it could enable info leaks or code execution.
CVE-2026-3063: DevTools Implementation Flaw
Malicious browser extensions can inject scripts into privileged pages. Found by M. Fauzan Wijaya (Gh05t666nero) on February 17, 2026, it heightens risks for users installing untrusted extensions.
Impact and Recommendations
All issues are remotely exploitable, with no evidence of in-the-wild attacks yet. NVD details are still emerging, and bug access is restricted until widespread patching.
Immediate Actions:
- Update Chrome to 145.0.7632.116 or later via Help > About Google Chrome.
- Enable auto-updates and monitor the Chrome Releases blog.
- Audit extensions; remove unknowns.
- For enterprises, prioritize Qualys scans and Patch Tuesday alignment.
Stay vigilant—these zero-days underscore why timely patching remains cybersecurity’s frontline defense.
