Chrome 149 Patches 11 Use-After-Free Flaws Enabling Sandbox Escapes

The update resolves four critical and 14 high-severity issues. Eleven are use-after-free defects, three critical. These allow attackers to corrupt freed memory objects during JavaScript execution, then chain to kernel or privileged process flaws for full host compromise. Google attributes 17 reports to internal teams and one critical case to an anonymous external researcher, with no in-the-wild exploitation declared in the advisory.

Internal discovery dominance aligns with the post-June 2024 pattern after the 429-patch spike. Use-after-free volume remains elevated because Chrome's V8 and Blink components retain complex object lifetimes despite prior mitigations. Sandbox escape chaining has appeared in documented campaigns against prior releases, where renderer bugs reached kernel via Windows or Linux primitives.

Users on Windows, macOS, and Linux must apply the update immediately. Absence of exploitation claims does not preclude targeted use; procurement records show continued investment in browser-targeted tooling by multiple state actors. Next stable release is expected within four weeks.