InfoSecBulletin Cybersecurity for mankind
Google has launched Chrome version 151.0.7922.108/.109 for Windows and macOS, and version 151.0.7922.108 for Linux. This update brings 41 security fixes for different parts of the browser, such as rendering, graphics, JavaScript, user interface (UI), media, and authentication.
Google Chrome 151 Update
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Contract and server dispute brought down Bangladesh’s digital payment
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
The update fixes six serious memory issues. Five of them are use-after-free (UAF) bugs that affect WebGL, Aura, Skia, and Views. The sixth problem is an out-of-bounds write error in ANGLE, which is Chrome’s graphics translation layer.
Memory problems can be very serious. A harmful website or special web content can cause browsers to crash, mess up memory, or possibly let bad code run if combined with other flaws. Independent reports indicate that the update addresses over two dozen memory-safety issues classified as either critical or high severity.
CVE-2026-19137 and CVE-2026-19170 are important flaws. They are both UAF problems in WebGL. WebGL helps run 2D and 3D graphics in browsers, making it a target for attackers who use harmful images. Other serious issues impact Aura, which is Chrome’s user interface system, Skia, its graphics library, and Views, another interface layer.
Google fixed 35 serious flaws. These include heap buffer overflows in CrashReporting and Base, several UAF weaknesses in GPU, HTML, V8, Media, Extensions, Payments, Web Authentication, and Skia, plus integer-overflow issues in GPU and V8.
The patch set fixes the lack of checking untrusted input in WebAPKs, Workers, Codecs, UI, and Contextual Tasks. V8 problems need special focus since V8 works with JavaScript and WebAssembly. This update fixes wrong code issues, a use-after-free bug, an out-of-bounds write, and an integer overflow in the engine.
Attackers often aim at browser scripting engines because a successful attack can give them a starting point in the renderer process. Then, they try to break out of the sandbox or gain more access. Google has kept some bug reports private while the update is shared. This is a common strategy to lower the chance of hackers using the bugs before users can fix them.
Organizations should focus on using this update on devices that visit unsafe websites, handle important tasks, or run web applications with GPU support.
Administrators can check the installed version by going to the Chrome menu → Help → About Google Chrome. For managed environments, Windows and macOS devices must get versions 151.0.7922.108/.109, and Linux systems need version 151.0.7922.108.
Chrome 151 CVE Table
| CVE | Severity | Vulnerability type | Affected component | Reporter / reward |
|---|---|---|---|---|
| CVE-2026-19137 | Critical | Use-after-free | WebGL | Anonymous / TBD |
| CVE-2026-19149 | Critical | Use-after-free | Aura | Google / N/A |
| CVE-2026-19154 | Critical | Use-after-free | Skia | Google / N/A |
| CVE-2026-19157 | Critical | Out-of-bounds write | ANGLE | Google / N/A |
| CVE-2026-19170 | Critical | Use-after-free | WebGL | STAR Labs SG researchers / TBD |
| CVE-2026-19172 | Critical | Use-after-free | Views | Google / N/A |
| CVE-2026-19138 | High | Heap buffer overflow | CrashReporting | Google / N/A |
| CVE-2026-19139 | High | Race condition | CredentialProvider | Google / N/A |
| CVE-2026-19140 | High | Use-after-free | GPU | Google / N/A |
| CVE-2026-19141 | High | Use-after-free | Resources | Google / N/A |
| CVE-2026-19142 | High | Use-after-free | Views | Google / N/A |
| CVE-2026-19143 | High | Insufficient validation | WebAPKs | Google / N/A |
| CVE-2026-19144 | High | Use-after-free | HTML | Google / N/A |
| CVE-2026-19145 | High | Use-after-free | Translate | Google / N/A |
| CVE-2026-19146 | High | Uninitialized use | GPU | Google / N/A |
| CVE-2026-19147 | High | Use-after-free | Aura | Google / N/A |
| CVE-2026-19148 | High | Out-of-bounds write | GPU | Google / N/A |
| CVE-2026-19150 | High | Inappropriate implementation | V8 | Google / N/A |
| CVE-2026-19151 | High | Use-after-free | V8 | Google / N/A |
| CVE-2026-19152 | High | Inappropriate implementation | Navigation | Google / N/A |
| CVE-2026-19153 | High | Insufficient validation | Workers | Google / N/A |
| CVE-2026-19155 | High | Use-after-free | Payments | Google / N/A |
| CVE-2026-19156 | High | Heap buffer overflow | Base | Viktoria Zlatinova / TBD |
| CVE-2026-19158 | High | Use-after-free | Views | Google / N/A |
| CVE-2026-19159 | High | Use-after-free | Views | Google / N/A |
| CVE-2026-19160 | High | Uninitialized use | Skia | Google / N/A |
| CVE-2026-19161 | High | Uninitialized use | Skia | Google / N/A |
| CVE-2026-19162 | High | Out-of-bounds write | V8 | OpenAI Codex Security / TBD |
| CVE-2026-19163 | High | Use-after-free | Media | Google / N/A |
| CVE-2026-19164 | High | Insufficient validation | Codecs | Google / N/A |
| CVE-2026-19165 | High | Use-after-free | Extensions | @bean5oup / TBD |
| CVE-2026-19166 | High | Use-after-free | Web Authentication | heesun / TBD |
| CVE-2026-19167 | High | Integer overflow | GPU | Google / N/A |
| CVE-2026-19168 | High | Inappropriate implementation | V8 | XBOW / $500 |
| CVE-2026-19169 | High | Insufficient validation | Contextual Tasks | Sven Dysthe / $5,000 |
| CVE-2026-19171 | High | Use-after-free | Media | Google / N/A |
| CVE-2026-19173 | High | Out-of-bounds write | Skia | Vu Van Tien / TBD |
| CVE-2026-19174 | High | Integer overflow | V8 | Seunghyun Lee, QED Audit / TBD |
| CVE-2026-19175 | High | Use-after-free | Payments | Google / N/A |
| CVE-2026-19176 | High | Use-after-free | Skia | WinD39 – Huynh Dinh Vu / TBD |
| CVE-2026-19177 | High | Insufficient validation | UI | Fabian Wahle, Hap Security / TBD |
