Loading story…
Google has released a Chrome desktop stable-channel update to address 15 security issues, including two critical buffer overflow vulnerabilities that could let a remote attacker achieve arbitrary code execution outside the browser sandbox through a crafted HTML page. The flaws are tracked as CVE-2026-76034 in WebGL and CVE-2026-76036 in Dawn, the graphics library that implements the WebGPU standard, raising the risk that a user could be compromised simply by visiting a malicious or compromised website.
The update brings Chrome to version 151.0.7922.169/.170 on Windows and macOS and 151.0.7922.169 on Linux. The patched vulnerabilities affect desktop Chrome across all three platforms, and the presence of sandbox-escape-capable browser bugs makes the release particularly urgent because successful exploitation could move execution from browser content directly onto the host system.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The published CVE record for CVE-2026-76036 identified the critical Dawn buffer overflow as affecting Google Chrome on Android versions prior to 151.0.7922.169. The flaw can be exploited via a crafted HTML page to achieve arbitrary code execution outside the sandbox.
Google released a Chrome desktop stable-channel update with 15 security fixes, upgrading Windows and macOS to version 151.0.7922.169/.170 and Linux to 151.0.7922.169. The update fixes two critical buffer overflow vulnerabilities, CVE-2026-76034 in WebGL and CVE-2026-76036 in Dawn, both of which could allow remote code execution outside the browser sandbox via a crafted HTML page.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemalwarebytes.com
Open sourcecve.org
Open sourcechromereleases.googleblog.com
Open sourcew3.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released a Chrome Stable channel update to fix 15 security issues, including the critical vulnerability **CVE-2026-76034** in **WebGL**. The flaw is a `CWE-122` buffer overflow affecting Chrome versions prior to **151.0.7922.169**, and Google said it could be triggered by malicious web content. The update was issued as **151.0.7922.169/.170** for Windows and macOS and **151.0.7922.169** for Linux, with rollout occurring gradually. According to the CVE record, **CVE-2026-76034** could let a remote attacker execute arbitrary code outside the browser sandbox by persuading a user to open a crafted HTML page. Google also disclosed a second critical buffer overflow, **CVE-2026-76036**, in **Dawn**, Chromium’s WebGPU implementation, but said detailed technical information and bug reports are being withheld until most users have installed the fixes to reduce the risk of weaponization through patch reverse engineering.
Aug 21, 2026
Google released Chrome 152 for Windows, macOS, and Linux with fixes for 327 vulnerabilities, including 18 rated critical and 53 rated high severity. Affected desktop versions are `152.0.7977.64/.65` for Windows and macOS and `152.0.7977.64` for Linux. The fixes address arbitrary-code-execution, security-bypass, and information-disclosure risks; Google has restricted access to some bug details while users deploy the update and reports no known active exploitation. The most significant fixes include `CVE-2026-79282`, a use-after-free flaw in ANGLE that a malicious HTML page could exploit to execute code outside Chrome's browser sandbox, and `CVE-2026-78899`, a V8 use-after-free vulnerability rated CVSS 8.8 that could enable code execution within the sandbox. Organizations should urgently update managed Chrome installations and require browser restarts, as both flaws are reachable through malicious websites and could be combined in exploit chains.
Aug 27, 2026
Google has released a major Chrome security update fixing **382 vulnerabilities** across Windows, macOS, Linux, iOS, and Android, including **15 critical** and **67 high-severity** flaws. The patched bugs span components such as **Extensions, GPU, WebUSB, Browser, Bluetooth, Chromoting, Ozone, Dawn/WebGPU, ANGLE, Skia, Views, Fullscreen, and iOSWeb**, with many involving `use-after-free`, `type confusion`, out-of-bounds access, uninitialized use, and insufficient validation of untrusted input. Google said **358** of the issues were found internally through tooling and fuzzing, while others were reported by external researchers. Several of the vulnerabilities could be triggered through crafted web content to achieve renderer compromise, heap corruption, control-flow hijacking, and in some cases **sandbox escape** leading to code execution on the underlying system. Reported examples include **CVE-2026-13789**, a high-severity `use-after-free` flaw in the GPU component that could enable a remote attacker with renderer access to escape the sandbox, along with critical issues such as **CVE-2026-13774**, **CVE-2026-13775**, **CVE-2026-13776**, **CVE-2026-13778**, **CVE-2026-13782**, **CVE-2026-13785**, and **CVE-2026-13788**. Google said it had **no evidence of in-the-wild exploitation** at release, but urged rapid deployment of the update, particularly in enterprise environments and for Chromium-based browsers.
Jul 12, 2026