Chrome 143 Patches Critical CVE‑2026‑0628 and Implements Push API Rate Limits to Thwart Spam

Breaking: Chrome Fixes High-Severity CVE and Introduces Push API Rate Limits

In a swift response to a critical security flaw, the latest Chrome update, version 143, patches a high-severity vulnerability identified as CVE-2026-0628. The move comes alongside a new enforcement on push notifications, as Google implements rate limits on the Push API to curb notification spam. Penalties for abuse can extend up to 14 days.

What changed and why it matters

Security teams say the CVE-2026-0628 patch closes a vulnerability that could be exploited to compromise user devices or data. By delivering the fix in Chrome 143, Google aims to reduce attacker opportunities and strengthen browser integrity for billions of users.

Alongside the patch, Google introduced rate controls for the Push API.The goal is to curb abusive or excessive push notifications that can overwhelm users and degrade the browsing experience. The policy includes penalties that can reach up to two weeks, underscoring a stricter stance against abuse.

Impact on users, developers, and the broader ecosystem

For everyday users, the update means better protection against targeted exploits and fewer spammy notifications. For developers and site operators, it signals a renewed emphasis on responsible notification practices and adherence to platform policies when using push messaging.

Industry observers note that this pattern—patching a critical flaw while tightening related delivery mechanisms—is part of a broader shift toward safer, user-kind web experiences. Keeping software up to date remains the fastest path to reducing risk.

Key facts at a glance

Item	Details
Chrome version	143
Vulnerability	CVE-2026-0628 (high severity)
Additional change	Push API rate limits to curb notification spam
Penalty for abuse	Up to 14 days
Primary purpose	Enhance security; reduce notification fatigue

evergreen insights: sustaining value beyond the patch

First, users should enable automatic updates to ensure Chrome remains protected without manual intervention. Regularly review installed extensions and notification permissions to minimize risk exposure.

Second, developers should audit Push API usage, implement opt-in consent, and establish clear notification guidelines to avoid spamming audiences. integrating user-friendly controls to manage notification frequency can improve engagement while staying compliant.

Practical steps for readers

• Update chrome to version 143 or newer quickly.
• Review and limit push notification deployments on sites you manage or frequently visit.
• Monitor device and browser security advisories for additional patch notices.

For official guidance on updating Chrome and managing notifications, consult the browser’s support resources and security notices from the publisher.

Engagement questions

Have you updated to the latest Chrome release and verified the patch is active on your devices?

Do you run websites or apps that rely on push notifications, and how are you enforcing responsible use to avoid user fatigue?

Share your experiences with this update in the comments, or tell us how you adapt notification strategies to protect users while maintaining engagement.

Potential impact Full browser takeover, data exfiltration, credential theft, and drive‑by malware installation

Why it mattered:

Chrome 143 Release Highlights

• Version number: Chrome 143 (stable channel)
• Release date: 12 January 2026, 20:49 UTC
• Key focus: Security hardening and anti‑spam measures

---

Critical Vulnerability CVE‑2026‑0628: What Changed?

Aspect	Details
CVE ID	CVE‑2026‑0628
Severity	Critical (CVSS 9.8)
Affected component	Blink‑based JavaScript engine – specifically the ArrayBuffer / SharedArrayBuffer handling logic
Exploit vector	Remote code execution through crafted web pages that trigger out‑of‑bounds memory reads/writes
Potential impact	Full browser takeover, data exfiltration, credential theft, and drive‑by malware installation

Why it mattered:

Attackers could inject malicious payloads into a victim’s browsing session without any user interaction beyond loading a compromised page. The flaw bypassed existing sandbox protections, making it one of the most perilous web‑engine bugs of 2026.

---

How Chrome 143 Patches CVE‑2026‑0628

1. Boundary check reinforcement – New runtime checks validate all ArrayBuffer length calculations before memory allocation.
2. Strict type‑conflict validation – The engine now rejects mismatched TypedArray conversions that previously allowed pointer manipulation.
3. Memory‑sanitizer integration – Chrome 143 ships with an updated address‑space layout randomization (ASLR) scheme that randomizes buffer offsets on each page load.
4. Patch rollout – The fix is included in the stable channel (v143.0.0) and back‑ported to the beta and extended‑stable branches for enterprises still on earlier releases.

Pro tip: After updating, verify the patch is active by visiting chrome://version/ and confirming the build number ends with “143.0.0”.

---

Push API Rate Limits: New Anti‑Spam Shield

Why the Push API Needed Limiting

• Abuse trend: Malicious sites were using the Push API to send thousands of unsolicited notifications per user per hour, fueling phishing campaigns.
• User experiance: Excessive push messages lead to notification fatigue, increasing the likelihood of users clicking unsafe alerts.

How Chrome 143 Enforces Limits

Limit	Definition	Effect
Per‑origin daily quota	Max 5 push messages per origin per day for non‑active tabs	Prevents background spam bursts
Burst rate cap	No more than 2 push events per second per origin	Stops rapid fire attacks
Grace period	After hitting the quota, a 24‑hour cool‑down before new pushes are allowed	Encourages responsible use

– The limits are dynamic: origins with a strong user‑engagement score (e.g., high click‑through rates) receive a modestly higher allowance, while newly registered services start with the baseline quota.

• Developers receive console warnings ([Push API] Rate limit exceeded) and can query the current quota via the new PushManager.getQuota() method.

Real‑World Impact

• Case study: A phishing kit that previously generated ≈ 10,000 push spam messages per day per victim was reduced to under 30 after Chrome 143’s enforcement, according to telemetry shared by the Google Safe Browsing team.
• Enterprise benefit: Security teams reported a 40 % drop in push‑based credential‑theft alerts within the first week of the rollout.

---

Practical Tips for Web Developers

1. Check quota before sending:

“`javascript

const quota = await navigator.serviceWorker.ready.then(

reg => reg.pushManager.getQuota()

);

if (quota.remaining > 0) {

// send push

} else {

console.warn(‘Push quota exhausted’);

}

“`

2. Implement exponential back‑off for retrying failed push attempts—avoids hitting the burst cap.
3. Monitor console warnings during development; Chrome 143 logs detailed rate‑limit events that help tune notification frequency.
4. Update manifest – Add "push": { "rate_limit": "default" } to signal compliance with the new policy to Chrome’s runtime.

---

Benefits of Chrome 143’s Dual Fix

• Enhanced security posture: Eliminates a critical code‑execution pathway, protecting both personal users and corporate environments.
• Reduced spam vector: Push API throttling curtails large‑scale notification abuse, directly improving user trust.
• Compliance-amiable: Organizations can demonstrate proactive mitigation of known CVEs and adherence to best‑practice notification policies.
• Performance neutrality: Rate‑limit logic runs in the browser’s background thread,ensuring no perceptible slowdown for legitimate push traffic.

---

Checklist for IT Administrators

• ☐ Verify all endpoints run Chrome 143 or later (use GPO or MDM to enforce version).
• ☐ Review Chrome Enterprise Release notes for additional hardening recommendations.
• ☐ Audit internal web applications that rely on the Push API; adjust quotas where necessary.
• ☐ Enable Chrome’s “Enterprise Safe Browsing” feature to complement the CVE‑2026‑0628 patch.
• ☐ Communicate the update to end‑users, highlighting the reduced spam risk and improved security.

---