Google Chrome Security Update – 21 January 2026

The addressed vulnerabilities could allow the remote attacker to exploit object corruption and heap corruption via a crafted HTML page, perform UI spoofing and domain spoofing, bypass security restrictions, obtain sensitive information, spoof the contents of the Omnibox, perform an out-of-bounds memory read, and gain access to the affected product.

Sample of the addressed vulnerabilities:

1. Google Chrome Insufficient Policy Enforcement Vulnerability in Network (CVE-2026-0905):

• CVSS: 9.8
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Obtain Information

2. Google Chrome Use after free Vulnerability in ANGLE (CVE-2026-0908):

• CVSS: 8.8
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Consequences: Gain Access