InfoSecBulletin Cybersecurity for mankind
Google has launched Chrome version 151.0.7922.108/.109 for Windows and macOS, and version 151.0.7922.108 for Linux. This update brings 41 security fixes for different parts of the browser, such as rendering, graphics, JavaScript, user interface (UI), media, and authentication.
Google Chrome 151 Update
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
The update fixes six serious memory issues. Five of them are use-after-free (UAF) bugs that affect WebGL, Aura, Skia, and Views. The sixth problem is an out-of-bounds write error in ANGLE, which is Chrome’s graphics translation layer.
Memory problems can be very serious. A harmful website or special web content can cause browsers to crash, mess up memory, or possibly let bad code run if combined with other flaws. Independent reports indicate that the update addresses over two dozen memory-safety issues classified as either critical or high severity.
CVE-2026-19137 and CVE-2026-19170 are important flaws. They are both UAF problems in WebGL. WebGL helps run 2D and 3D graphics in browsers, making it a target for attackers who use harmful images. Other serious issues impact Aura, which is Chrome’s user interface system, Skia, its graphics library, and Views, another interface layer.
Google fixed 35 serious flaws. These include heap buffer overflows in CrashReporting and Base, several UAF weaknesses in GPU, HTML, V8, Media, Extensions, Payments, Web Authentication, and Skia, plus integer-overflow issues in GPU and V8.
The patch set fixes the lack of checking untrusted input in WebAPKs, Workers, Codecs, UI, and Contextual Tasks. V8 problems need special focus since V8 works with JavaScript and WebAssembly. This update fixes wrong code issues, a use-after-free bug, an out-of-bounds write, and an integer overflow in the engine.
Attackers often aim at browser scripting engines because a successful attack can give them a starting point in the renderer process. Then, they try to break out of the sandbox or gain more access. Google has kept some bug reports private while the update is shared. This is a common strategy to lower the chance of hackers using the bugs before users can fix them.
Organizations should focus on using this update on devices that visit unsafe websites, handle important tasks, or run web applications with GPU support.
Administrators can check the installed version by going to the Chrome menu → Help → About Google Chrome. For managed environments, Windows and macOS devices must get versions 151.0.7922.108/.109, and Linux systems need version 151.0.7922.108.
Chrome 151 CVE Table
| CVE | Severity | Vulnerability type | Affected component | Reporter / reward |
|---|---|---|---|---|
| CVE-2026-19137 | Critical | Use-after-free | WebGL | Anonymous / TBD |
| CVE-2026-19149 | Critical | Use-after-free | Aura | Google / N/A |
| CVE-2026-19154 | Critical | Use-after-free | Skia | Google / N/A |
| CVE-2026-19157 | Critical | Out-of-bounds write | ANGLE | Google / N/A |
| CVE-2026-19170 | Critical | Use-after-free | WebGL | STAR Labs SG researchers / TBD |
| CVE-2026-19172 | Critical | Use-after-free | Views | Google / N/A |
| CVE-2026-19138 | High | Heap buffer overflow | CrashReporting | Google / N/A |
| CVE-2026-19139 | High | Race condition | CredentialProvider | Google / N/A |
| CVE-2026-19140 | High | Use-after-free | GPU | Google / N/A |
| CVE-2026-19141 | High | Use-after-free | Resources | Google / N/A |
| CVE-2026-19142 | High | Use-after-free | Views | Google / N/A |
| CVE-2026-19143 | High | Insufficient validation | WebAPKs | Google / N/A |
| CVE-2026-19144 | High | Use-after-free | HTML | Google / N/A |
| CVE-2026-19145 | High | Use-after-free | Translate | Google / N/A |
| CVE-2026-19146 | High | Uninitialized use | GPU | Google / N/A |
| CVE-2026-19147 | High | Use-after-free | Aura | Google / N/A |
| CVE-2026-19148 | High | Out-of-bounds write | GPU | Google / N/A |
| CVE-2026-19150 | High | Inappropriate implementation | V8 | Google / N/A |
| CVE-2026-19151 | High | Use-after-free | V8 | Google / N/A |
| CVE-2026-19152 | High | Inappropriate implementation | Navigation | Google / N/A |
| CVE-2026-19153 | High | Insufficient validation | Workers | Google / N/A |
| CVE-2026-19155 | High | Use-after-free | Payments | Google / N/A |
| CVE-2026-19156 | High | Heap buffer overflow | Base | Viktoria Zlatinova / TBD |
| CVE-2026-19158 | High | Use-after-free | Views | Google / N/A |
| CVE-2026-19159 | High | Use-after-free | Views | Google / N/A |
| CVE-2026-19160 | High | Uninitialized use | Skia | Google / N/A |
| CVE-2026-19161 | High | Uninitialized use | Skia | Google / N/A |
| CVE-2026-19162 | High | Out-of-bounds write | V8 | OpenAI Codex Security / TBD |
| CVE-2026-19163 | High | Use-after-free | Media | Google / N/A |
| CVE-2026-19164 | High | Insufficient validation | Codecs | Google / N/A |
| CVE-2026-19165 | High | Use-after-free | Extensions | @bean5oup / TBD |
| CVE-2026-19166 | High | Use-after-free | Web Authentication | heesun / TBD |
| CVE-2026-19167 | High | Integer overflow | GPU | Google / N/A |
| CVE-2026-19168 | High | Inappropriate implementation | V8 | XBOW / $500 |
| CVE-2026-19169 | High | Insufficient validation | Contextual Tasks | Sven Dysthe / $5,000 |
| CVE-2026-19171 | High | Use-after-free | Media | Google / N/A |
| CVE-2026-19173 | High | Out-of-bounds write | Skia | Vu Van Tien / TBD |
| CVE-2026-19174 | High | Integer overflow | V8 | Seunghyun Lee, QED Audit / TBD |
| CVE-2026-19175 | High | Use-after-free | Payments | Google / N/A |
| CVE-2026-19176 | High | Use-after-free | Skia | WinD39 – Huynh Dinh Vu / TBD |
| CVE-2026-19177 | High | Insufficient validation | UI | Fabian Wahle, Hap Security / TBD |
