InfoSecBulletin Cybersecurity for mankind
Google has launched Chrome version 151.0.7922.108/.109 for Windows and macOS, and version 151.0.7922.108 for Linux. This update brings 41 security fixes for different parts of the browser, such as rendering, graphics, JavaScript, user interface (UI), media, and authentication.
Google Chrome 151 Update
Rapid7 Unveils 17 Zimbra Collaboration Suite Flaws Breaking Identity Boundaries
CISA launched two free tools Identify Security Misconfig in Microsoft 365 and Google Workspace
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
The update fixes six serious memory issues. Five of them are use-after-free (UAF) bugs that affect WebGL, Aura, Skia, and Views. The sixth problem is an out-of-bounds write error in ANGLE, which is Chrome’s graphics translation layer.
Memory problems can be very serious. A harmful website or special web content can cause browsers to crash, mess up memory, or possibly let bad code run if combined with other flaws. Independent reports indicate that the update addresses over two dozen memory-safety issues classified as either critical or high severity.
CVE-2026-19137 and CVE-2026-19170 are important flaws. They are both UAF problems in WebGL. WebGL helps run 2D and 3D graphics in browsers, making it a target for attackers who use harmful images. Other serious issues impact Aura, which is Chrome’s user interface system, Skia, its graphics library, and Views, another interface layer.
Google fixed 35 serious flaws. These include heap buffer overflows in CrashReporting and Base, several UAF weaknesses in GPU, HTML, V8, Media, Extensions, Payments, Web Authentication, and Skia, plus integer-overflow issues in GPU and V8.
The patch set fixes the lack of checking untrusted input in WebAPKs, Workers, Codecs, UI, and Contextual Tasks. V8 problems need special focus since V8 works with JavaScript and WebAssembly. This update fixes wrong code issues, a use-after-free bug, an out-of-bounds write, and an integer overflow in the engine.
Attackers often aim at browser scripting engines because a successful attack can give them a starting point in the renderer process. Then, they try to break out of the sandbox or gain more access. Google has kept some bug reports private while the update is shared. This is a common strategy to lower the chance of hackers using the bugs before users can fix them.
Organizations should focus on using this update on devices that visit unsafe websites, handle important tasks, or run web applications with GPU support.
Administrators can check the installed version by going to the Chrome menu → Help → About Google Chrome. For managed environments, Windows and macOS devices must get versions 151.0.7922.108/.109, and Linux systems need version 151.0.7922.108.
Chrome 151 CVE Table
| CVE | Severity | Vulnerability type | Affected component | Reporter / reward |
|---|---|---|---|---|
| CVE-2026-19137 | Critical | Use-after-free | WebGL | Anonymous / TBD |
| CVE-2026-19149 | Critical | Use-after-free | Aura | Google / N/A |
| CVE-2026-19154 | Critical | Use-after-free | Skia | Google / N/A |
| CVE-2026-19157 | Critical | Out-of-bounds write | ANGLE | Google / N/A |
| CVE-2026-19170 | Critical | Use-after-free | WebGL | STAR Labs SG researchers / TBD |
| CVE-2026-19172 | Critical | Use-after-free | Views | Google / N/A |
| CVE-2026-19138 | High | Heap buffer overflow | CrashReporting | Google / N/A |
| CVE-2026-19139 | High | Race condition | CredentialProvider | Google / N/A |
| CVE-2026-19140 | High | Use-after-free | GPU | Google / N/A |
| CVE-2026-19141 | High | Use-after-free | Resources | Google / N/A |
| CVE-2026-19142 | High | Use-after-free | Views | Google / N/A |
| CVE-2026-19143 | High | Insufficient validation | WebAPKs | Google / N/A |
| CVE-2026-19144 | High | Use-after-free | HTML | Google / N/A |
| CVE-2026-19145 | High | Use-after-free | Translate | Google / N/A |
| CVE-2026-19146 | High | Uninitialized use | GPU | Google / N/A |
| CVE-2026-19147 | High | Use-after-free | Aura | Google / N/A |
| CVE-2026-19148 | High | Out-of-bounds write | GPU | Google / N/A |
| CVE-2026-19150 | High | Inappropriate implementation | V8 | Google / N/A |
| CVE-2026-19151 | High | Use-after-free | V8 | Google / N/A |
| CVE-2026-19152 | High | Inappropriate implementation | Navigation | Google / N/A |
| CVE-2026-19153 | High | Insufficient validation | Workers | Google / N/A |
| CVE-2026-19155 | High | Use-after-free | Payments | Google / N/A |
| CVE-2026-19156 | High | Heap buffer overflow | Base | Viktoria Zlatinova / TBD |
| CVE-2026-19158 | High | Use-after-free | Views | Google / N/A |
| CVE-2026-19159 | High | Use-after-free | Views | Google / N/A |
| CVE-2026-19160 | High | Uninitialized use | Skia | Google / N/A |
| CVE-2026-19161 | High | Uninitialized use | Skia | Google / N/A |
| CVE-2026-19162 | High | Out-of-bounds write | V8 | OpenAI Codex Security / TBD |
| CVE-2026-19163 | High | Use-after-free | Media | Google / N/A |
| CVE-2026-19164 | High | Insufficient validation | Codecs | Google / N/A |
| CVE-2026-19165 | High | Use-after-free | Extensions | @bean5oup / TBD |
| CVE-2026-19166 | High | Use-after-free | Web Authentication | heesun / TBD |
| CVE-2026-19167 | High | Integer overflow | GPU | Google / N/A |
| CVE-2026-19168 | High | Inappropriate implementation | V8 | XBOW / $500 |
| CVE-2026-19169 | High | Insufficient validation | Contextual Tasks | Sven Dysthe / $5,000 |
| CVE-2026-19171 | High | Use-after-free | Media | Google / N/A |
| CVE-2026-19173 | High | Out-of-bounds write | Skia | Vu Van Tien / TBD |
| CVE-2026-19174 | High | Integer overflow | V8 | Seunghyun Lee, QED Audit / TBD |
| CVE-2026-19175 | High | Use-after-free | Payments | Google / N/A |
| CVE-2026-19176 | High | Use-after-free | Skia | WinD39 – Huynh Dinh Vu / TBD |
| CVE-2026-19177 | High | Insufficient validation | UI | Fabian Wahle, Hap Security / TBD |
