InfoSecBulletin Cybersecurity for mankind
Google has launched Chrome version 151.0.7922.108/.109 for Windows and macOS, and version 151.0.7922.108 for Linux. This update brings 41 security fixes for different parts of the browser, such as rendering, graphics, JavaScript, user interface (UI), media, and authentication.
Google Chrome 151 Update
700 AI agents united to hack Hugging Face after breaking isolation
ServiceNow warns of three critical security vulnerabilities
100+ Tech and Security Orgs Urge Global Cyber Defense Boost Against AI Threats
8.7 Million Customers data exposed from 3 Airports
Crack 85 Accounts and Steal 2,500+ Records
8-Agent AI Framework Used to Compromise Gov’t Entities in Asia
270+ Zimbra servers compromised in continuous attacks
Singapore Approves 200MW Data-Centre Expansion Under Second Call
Chameleon SEO Poisoning
Hackers poison Bing and Google search results to deliver phishing banking pages
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
The update fixes six serious memory issues. Five of them are use-after-free (UAF) bugs that affect WebGL, Aura, Skia, and Views. The sixth problem is an out-of-bounds write error in ANGLE, which is Chrome’s graphics translation layer.
Memory problems can be very serious. A harmful website or special web content can cause browsers to crash, mess up memory, or possibly let bad code run if combined with other flaws. Independent reports indicate that the update addresses over two dozen memory-safety issues classified as either critical or high severity.
CVE-2026-19137 and CVE-2026-19170 are important flaws. They are both UAF problems in WebGL. WebGL helps run 2D and 3D graphics in browsers, making it a target for attackers who use harmful images. Other serious issues impact Aura, which is Chrome’s user interface system, Skia, its graphics library, and Views, another interface layer.
Google fixed 35 serious flaws. These include heap buffer overflows in CrashReporting and Base, several UAF weaknesses in GPU, HTML, V8, Media, Extensions, Payments, Web Authentication, and Skia, plus integer-overflow issues in GPU and V8.
The patch set fixes the lack of checking untrusted input in WebAPKs, Workers, Codecs, UI, and Contextual Tasks. V8 problems need special focus since V8 works with JavaScript and WebAssembly. This update fixes wrong code issues, a use-after-free bug, an out-of-bounds write, and an integer overflow in the engine.
Attackers often aim at browser scripting engines because a successful attack can give them a starting point in the renderer process. Then, they try to break out of the sandbox or gain more access. Google has kept some bug reports private while the update is shared. This is a common strategy to lower the chance of hackers using the bugs before users can fix them.
Organizations should focus on using this update on devices that visit unsafe websites, handle important tasks, or run web applications with GPU support.
Administrators can check the installed version by going to the Chrome menu → Help → About Google Chrome. For managed environments, Windows and macOS devices must get versions 151.0.7922.108/.109, and Linux systems need version 151.0.7922.108.
Chrome 151 CVE Table
| CVE | Severity | Vulnerability type | Affected component | Reporter / reward |
|---|---|---|---|---|
| CVE-2026-19137 | Critical | Use-after-free | WebGL | Anonymous / TBD |
| CVE-2026-19149 | Critical | Use-after-free | Aura | Google / N/A |
| CVE-2026-19154 | Critical | Use-after-free | Skia | Google / N/A |
| CVE-2026-19157 | Critical | Out-of-bounds write | ANGLE | Google / N/A |
| CVE-2026-19170 | Critical | Use-after-free | WebGL | STAR Labs SG researchers / TBD |
| CVE-2026-19172 | Critical | Use-after-free | Views | Google / N/A |
| CVE-2026-19138 | High | Heap buffer overflow | CrashReporting | Google / N/A |
| CVE-2026-19139 | High | Race condition | CredentialProvider | Google / N/A |
| CVE-2026-19140 | High | Use-after-free | GPU | Google / N/A |
| CVE-2026-19141 | High | Use-after-free | Resources | Google / N/A |
| CVE-2026-19142 | High | Use-after-free | Views | Google / N/A |
| CVE-2026-19143 | High | Insufficient validation | WebAPKs | Google / N/A |
| CVE-2026-19144 | High | Use-after-free | HTML | Google / N/A |
| CVE-2026-19145 | High | Use-after-free | Translate | Google / N/A |
| CVE-2026-19146 | High | Uninitialized use | GPU | Google / N/A |
| CVE-2026-19147 | High | Use-after-free | Aura | Google / N/A |
| CVE-2026-19148 | High | Out-of-bounds write | GPU | Google / N/A |
| CVE-2026-19150 | High | Inappropriate implementation | V8 | Google / N/A |
| CVE-2026-19151 | High | Use-after-free | V8 | Google / N/A |
| CVE-2026-19152 | High | Inappropriate implementation | Navigation | Google / N/A |
| CVE-2026-19153 | High | Insufficient validation | Workers | Google / N/A |
| CVE-2026-19155 | High | Use-after-free | Payments | Google / N/A |
| CVE-2026-19156 | High | Heap buffer overflow | Base | Viktoria Zlatinova / TBD |
| CVE-2026-19158 | High | Use-after-free | Views | Google / N/A |
| CVE-2026-19159 | High | Use-after-free | Views | Google / N/A |
| CVE-2026-19160 | High | Uninitialized use | Skia | Google / N/A |
| CVE-2026-19161 | High | Uninitialized use | Skia | Google / N/A |
| CVE-2026-19162 | High | Out-of-bounds write | V8 | OpenAI Codex Security / TBD |
| CVE-2026-19163 | High | Use-after-free | Media | Google / N/A |
| CVE-2026-19164 | High | Insufficient validation | Codecs | Google / N/A |
| CVE-2026-19165 | High | Use-after-free | Extensions | @bean5oup / TBD |
| CVE-2026-19166 | High | Use-after-free | Web Authentication | heesun / TBD |
| CVE-2026-19167 | High | Integer overflow | GPU | Google / N/A |
| CVE-2026-19168 | High | Inappropriate implementation | V8 | XBOW / $500 |
| CVE-2026-19169 | High | Insufficient validation | Contextual Tasks | Sven Dysthe / $5,000 |
| CVE-2026-19171 | High | Use-after-free | Media | Google / N/A |
| CVE-2026-19173 | High | Out-of-bounds write | Skia | Vu Van Tien / TBD |
| CVE-2026-19174 | High | Integer overflow | V8 | Seunghyun Lee, QED Audit / TBD |
| CVE-2026-19175 | High | Use-after-free | Payments | Google / N/A |
| CVE-2026-19176 | High | Use-after-free | Skia | WinD39 – Huynh Dinh Vu / TBD |
| CVE-2026-19177 | High | Insufficient validation | UI | Fabian Wahle, Hap Security / TBD |
