Chrome and GitLab Release Security Patches for Multiple High-Severity Flaws

Google released a Chrome Stable desktop update to 149.0.7827.196/197 for Windows and Mac and 149.0.7827.196 for Linux, fixing 18 security issues, including four rated critical. The most serious bugs include two WebGL use-after-free flaws, an out-of-bounds read in Blink InterestGroups, and a use-after-free issue in Autofill, alongside 14 high-severity vulnerabilities affecting components such as GPU, Navigation, DevTools, Web Authentication, Passwords, Bluetooth, and WebView. Public details for some flaws were temporarily restricted until more users receive the update or dependent third-party libraries are patched, and the Canadian Centre for Cyber Security urged organizations to apply the update for versions earlier than the fixed releases.

GitLab also issued security patch releases 19.1.1, 19.0.3, and 18.11.6 for Community Edition and Enterprise Edition, addressing 13 vulnerabilities and urging self-managed customers to upgrade immediately. The most severe issue, CVE-2026-10086, is a high-severity cross-site scripting flaw in the Analytics Dashboard for GitLab EE with a CVSS score of 8.7; other notable issues include CVE-2026-10712, an unauthenticated XSS flaw in the Web IDE workbench asset handler, and CVE-2026-12053, an information disclosure bug in Duo Workflows. GitLab said GitLab.com had already been patched and GitLab Dedicated customers required no action, while warning that included database migrations may cause downtime on single-node deployments unless zero-downtime upgrade procedures are used in multi-node environments.