Chrome 144 Put 10 Security Fixes on a Four-Week Clock

Google promoted Chrome 144 to the desktop stable channel on January 13, 2026, with 10 security fixes and no in-the-wild warning. Srinivas Sista signed the Windows, Mac, and Linux note, and the builds were 144.0.7559.59 on Linux and 144.0.7559.59 or 144.0.7559.60 on Windows and Mac.

Seven days earlier the 143 branch had already taken a one-bug emergency patch. The January 13 drop went back to the four-week script Google had used since 2021, and it now reads like a baseline for how small those notes used to be.

Chrome 144 Landed as a 10-Fix Desktop Drop

Sista’s post said the Chrome team was delighted to announce the promotion of Chrome 144, then pointed readers at the Chromium change log between 143.0.7499.193 and 144.0.7559.59. Bug details stayed restricted until most users had the fix, the usual line when a third-party library is still unpatched elsewhere.

THE JANUARY 13 DESKTOP BUILD

• The versions: 144.0.7559.59 on Linux, and 144.0.7559.59 or 144.0.7559.60 on Windows and Mac.
• The patch count: Google listed 10 security fixes for desktop Chrome, with the public note highlighting work from outside researchers.
• The split: 3 High, 4 Medium, and 3 Low, and none of the ten carried an exploited-in-the-wild tag.
• The prior note: On January 6, 2026, Chrome 143.0.7499.192 and 143.0.7499.193 shipped a single High fix, CVE-2026-0628, in the WebView tag.

Gal Weizman had reported that WebView bug on November 23, 2025. The January 6 bulletin treated it as a High policy-enforcement miss that needed a user to install a malicious extension, then 144 arrived a week later as a full milestone with a broader list.

Three High Bugs, One Filed in 2021

Google paid disclosed bounties of $8,000, $4,000, $3,000, $1,000, $2,000, and $500 on the named external reports, a public total of $18,500, with four entries still marked TBD. Three of the ten bugs sat in V8. One High Blink bug carried a report date of October 4, 2021.

THE 10 CVE ENTRIES ON THE 144 NOTE

Google’s wording on CVE-2026-0901 is “Inappropriate implementation in Blink,” with Kurniawan’s report dated October 4, 2021, more than four years before the stable ship. The note does not say why that file sat so long, only that it landed in this milestone as High. Hafiizh appears twice, on Digital Credentials and Split View, both UI issues that can spoof what the browser shows rather than smash memory.

What CVE-2026-0899 Broke in V8

The top payout was CVE-2026-0899, described as out of bounds memory access in V8 in builds prior to 144.0.7559.59. A remote attacker could try to corrupt objects through a crafted HTML page. CISA-ADP later scored it 8.8, with network access and user interaction required. The reporter posted the same day the note went up.

I found the vulnerability using my custom fuzzer.

p1nky (@p1nky4745), on the Chrome 144 stable note

The fix landed in V8 review 7203465. That is the same engine class Google kept patching all year, which is why a January High with no in-the-wild flag still drew exploit engineers. On April 1, 2026, Shreyas Penkar at STAR Labs published a walk-through of the patch, under guidance from Nguyễn Hoàng Thạch.

CVE-2026-0899 is an out-of-bounds access in V8’s parser during lazy recompilation of class member initializers when static blocks and instance fields are interleaved.

Shreyas Penkar, STAR Labs, April 1, 2026

Penkar’s team got as far as arbitrary read and write primitives only after they stripped a CHECK that still fired in the release build. In production, V8 caught a function-literal ID mismatch and crashed, which cut the path off. The January bug was real, and it was also fenced. That gap, a High on paper that still died on an assert, is the difference between a four-week note that looks calm and a later year in which V8 bugs stopped looking academic.

Edge, Opera and Vivaldi Waited on Chromium

Chrome’s own channel is only the first stop. A Gentoo Security bug opened on January 16, 2026, bundled the same ten CVE IDs against Chromium, Google Chrome, Microsoft Edge, Opera, and Vivaldi, because those products ingest the engine on their own clocks.

PACKAGE FLOORS IN THE GENTOO TRACKER

• Chromium and Chrome: builds before 144.0.7559.59.
• Microsoft Edge: builds before 144.0.3719.82.
• Opera: builds before 128.0.5807.25.
• Vivaldi: builds before 7.8.3925.56.

Those floors are distro packaging, not each vendor’s full advisory, but they show the lag. A desktop that auto-updates Chrome can be current while an Edge or Opera install on the same machine is still on a 143-era engine. Anti-detect browsers that sell spoofed fingerprints also advertised a Chrome 144 kernel in early 2026, which is another way the same binaries leave Google’s servers. ChromeOS long-term channels kept a 144 branch alive too; a March update on LTC 144 still listed Skia and V8 work on 144.0.7559.246.

A Simpler New Tab and a Cookie Plan in Reverse

The security list sat on top of a feature train that enterprise release notes had already flagged for 144. Google was opening Gemini agentic tools to some consumer users, tightening preference tampering protection for Windows enterprise installs, and turning on Happy Eyeballs V3 to cut visible connection delay. The new-tab page got a simpler layout. Chrome’s 144 beta notes also introduced a declarative <geolocation> element that handles the permission flow in HTML instead of a separate script call.

WHAT ELSE SHIPPED WITH 144

• Privacy Sandbox: deprecation of Topics, Protected Audience, Shared Storage, Attribution Reporting, Private Aggregation, and requestStorageAccessFor began in Chrome 144, with removal planned for Chrome 150.
• Gemini in Chrome: agentic capabilities were listed as arriving as early as 144 for some non-enterprise users, after the 143 rollout of multi-tab context capped at 10 tabs.
• Networking: Happy Eyeballs V3, plus multicast support for the Direct Sockets API.
• Enterprise Windows: preference tampering protection, aimed at stopping silent policy drift on managed PCs.
• Digital Credentials: a user-facing credentials UI that also produced CVE-2026-0904, a Medium incorrect-security-UI bug in this same drop.

The Privacy Sandbox turn is the odd one. After Google kept third-party cookies, it started retiring the APIs built to replace them. Sites that had wired server-side k-anonymity or coordinator flows were told to expect breakage, while most users would see no change during deprecation. None of those APIs were on by default for enterprise. The security UI bugs in Digital Credentials and Split View sit next to that shift: new chrome in the window, and new ways to lie about what the window is showing.

Why Chrome Now Ships Every Two Weeks

Chrome 144 was still a four-week major. Support for that branch ended when Chrome 145 took over, and the consumer rule stayed brutal: only the latest major gets security fixes. By September 8, 2026, Google had promoted Chrome 153 and, in a post by Ben Mason and Deepak Ravichandran, put in place the shift from a four- to a two-week cycle across desktop, Android, and iOS.

They tied the faster clock to patch volume from automated AI discovery tools and community reports, and to shrinking the N-day gap between a fix in the public tree and a fix on the machine. The 153 desktop builds were 153.0.8010.36 on Linux and 153.0.8010.36 or 153.0.8010.37 on Windows and Mac. That note listed 230 security fixes, and it said Google was aware that an exploit for CVE-2026-87491, another V8 memory bug, existed in the wild. Chrome 154 was already scheduled for September 22, 2026.

FROM THE 144 NOTE TO THE 153 NOTE

1. January 6, 2026: Chrome 143.0.7499.192 and 143.0.7499.193 ship 1 High fix, CVE-2026-0628 in the WebView tag.
2. January 13, 2026: Chrome 144 goes stable with 10 security fixes and no in-the-wild line.
3. April 1, 2026: STAR Labs publishes its CVE-2026-0899 write-up, reaching read/write only after disabling a release CHECK.
4. September 8, 2026: Chrome 153 goes stable with 230 security fixes, a two-week cadence, and an in-the-wild V8 bug, CVE-2026-87491.

TWO STABLE NOTES, NINE MONTHS APART

Google told enterprise admins that the two-week Stable channel is the most secure choice for most staff, with Extended Stable left for shops that cannot take a two-week rhythm. The company listed Microsoft, Mozilla, and Brave as peers on the faster clock, a path that includes Firefox’s move to two-week releases and the extra load that puts on extension makers. The January 13 note did not argue any of that. It shipped 10 fixes, paid a first-CVE fuzzer $8,000, and closed a Blink file dated 2021. The rest of 2026 was the bill for treating that as a normal month.

Frequently Asked Questions

When Did Chrome 144 Stop Getting Security Fixes?

Consumer security support for Chrome 144 ended on February 10, 2026, the day Chrome 145 became the current major on the old four-week clock. endoflife.date records that only the latest major receives new features, bug fixes, and security patches, so a desktop still sitting on 144.0.7559.59 is past that cut-off even if the window still opens.

How Do I Check My Chrome Version on Windows or Mac?

Open chrome://settings/help (Help, then About Google Chrome in the menu). The page checks for an update on its own; if a Relaunch button appears, that click is the step that applies the download. After relaunch, a current machine in September 2026 should show 153.0.8010.36 or 153.0.8010.37, not a 144 build.

Was CVE-2026-0899 Exploited in the Wild?

Google’s January 13, 2026 note did not say an exploit existed in the wild, and CISA-ADP later scored the bug at 8.8 with user interaction required. That is a different flag from the September 8, 2026 Chrome 153 bulletin, which named CVE-2026-87491 as exploited.

What Is Chrome Extended Stable?

Extended Stable is an enterprise-only channel that updates every 8 weeks, documented for admins who cannot take the default Stable rhythm. Regular Chrome users do not get it, and after September 8, 2026 Google told admins that two-week Stable is the more secure default for most staff.

Did Chrome 144 Remove Privacy Sandbox APIs?

No. Deprecation began in Chrome 144, and removal was planned for Chrome 150. After deprecation the APIs still exist, and Google said most users would see no disruption, though some server-side integrations could break. Enterprise builds did not have those APIs enabled by default, and the related policies were scheduled to go away with Chrome 150.