What happened: Google shipped an emergency-grade Chrome update fixing 18 vulnerabilities, four rated Critical. Two of them (CVE-2026-13028 and CVE-2026-13032) are “sandbox escape” bugs — a booby-trapped web page can break out of the browser’s protective bubble and reach the wider computer. None are confirmed exploited yet, but Chrome has already had several zero-days weaponized this year.
Why it matters to your business
Your team lives in the browser all day. A sandbox escape is the difference between “a bad website misbehaved in the tab” and “a bad website is now running on the machine.” One employee visiting one poisoned page on an unpatched browser is all it takes — and browsers that never get closed can sit unpatched for weeks.
What to do this week
Update every Chrome install to version 149.0.7827.196/197 or newer: click the three-dot menu → Settings → About Chrome, let it download, then restart the browser (the update doesn’t finish until you do). Tell staff that “I’ll close it later” is the gap attackers count on.
The bigger picture
This is exactly why patching can’t be left to whenever someone gets around to it. A proactively managed environment pushes and verifies these updates across every machine automatically — a reactive one finds out it was behind after something breaks: Proactive vs. Reactive IT Management.