Google ChromeOS Update Patches Critical Use-After-Free Flaws in AdFilter and WindowDialog

The latest Stable Channel update for ChromeOS addresses multiple high and critical browser security vulnerabilities, including memory corruption issues.

Threat Times Exposure DeskOctober 10, 20262 min read

Share LinkedIn Reddit

Illustration: A sleek chromebook rests on a clean desk, its blank screen reflecting soft light. — AI-generated illustration: Threat Times

Key points

ChromeOS Stable Channel updates to version 16805.33.0 with Browser version 154.0.8037.151.
Fixes include two critical use-after-free vulnerabilities in AdFilter and WindowDialog components.
Android-specific sandbox weakening and GPU process memory corruption issues are also resolved.

Google has released a Stable Channel update for ChromeOS and ChromeOS Flex, addressing several high and critical security vulnerabilities in the underlying browser engine and operating system components. The update pushes OS version 16805.33.0 and Browser version 154.0.8037.151 to most ChromeOS devices, closing gaps that could allow attackers to compromise system integrity or execute arbitrary code.

At a glance

Publisher: Google Chrome Releases
CVEs: See advisory

The most significant fixes in this release target memory management errors within the Chrome browser environment. According to the official advisory from Google Chrome Releases, two vulnerabilities rated as critical involve use-after-free flaws in the AdFilter and WindowDialog components. Additionally, a high-severity use-after-free vulnerability in the Views component has been patched. These memory corruption issues typically allow remote attackers to execute code by crafting malicious web content that tricks the browser into accessing freed memory regions.

Browser and Engine Vulnerabilities

Beyond the critical memory errors, the update resolves five high-severity issues within the V8 JavaScript engine, which is central to Chrome's performance and security model. These include a type confusion vulnerability, an out-of-bounds write error, and a race condition, all of which were reported in September 2026. A separate high-severity use-after-free flaw in the WebAudio component has also been fixed. Most of these browser-related vulnerabilities were identified by researcher Xinyang Ge, who reported the AdFilter, WindowDialog, Views, and V8 issues between September 11 and September 15, 2026. The WebAudio flaw was reported by HoneyBee on September 10, 2026.

System-Level Security Improvements

The update also introduces fixes for system-level components outside the main browser engine. A high-severity vulnerability in the mali_kbase driver was addressed; this use-after-free write in the delete_hoarded_chunks function allowed the GPU process to corrupt kernel memory. Furthermore, a potential sandbox weakening issue in crosvm was resolved. The advisory notes that an unvalidated wayland_server field in the StartArcVm process could have compromised the security boundary of the Android runtime environment. No specific CVE IDs are listed for these system-level fixes in the advisory.

What should you do?

Administrators and users should ensure their ChromeOS devices are set to update automatically or manually check for the latest Stable Channel version to mitigate these risks. Since the update is already deployed to the Stable Channel, affected devices should receive the patch automatically upon connection to the internet. Organizations managing fleets of Chromebooks should verify that devices have successfully installed version 16805.33.0 to ensure protection against the disclosed vulnerabilities.

What to do and how to stay safe: ChromeOS

Verify that ChromeOS devices are running the latest Stable Channel version by checking the system settings for OS version 16805.33.0.
Ensure automatic updates are enabled to receive future security patches without manual intervention.
Monitor official Google security advisories for additional details on vulnerability severity and potential exploitation.
Review Android application permissions and sandbox settings if devices rely heavily on the ARC++ runtime environment.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.