Loading story…
Google released a Chrome Stable channel update to fix 15 security issues, including the critical vulnerability CVE-2026-76034 in WebGL. The flaw is a CWE-122 buffer overflow affecting Chrome versions prior to 151.0.7922.169, and Google said it could be triggered by malicious web content. The update was issued as 151.0.7922.169/.170 for Windows and macOS and 151.0.7922.169 for Linux, with rollout occurring gradually.
According to the CVE record, CVE-2026-76034 could let a remote attacker execute arbitrary code outside the browser sandbox by persuading a user to open a crafted HTML page. Google also disclosed a second critical buffer overflow, CVE-2026-76036, in Dawn, Chromium’s WebGPU implementation, but said detailed technical information and bug reports are being withheld until most users have installed the fixes to reduce the risk of weaponization through patch reverse engineering.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Debian published security advisory DSA-6455 for the Chromium source package in Debian trixie, tracking multiple Chromium vulnerabilities including CVE-2026-76033 through CVE-2026-76047. The advisory context materially associates Debian’s Chromium package with the same vulnerability cluster that included CVE-2026-76034 and CVE-2026-76036.
Google issued a Chrome stable-channel update referenced by Tenable for Windows systems, recommending upgrade to version 151.0.7922.173 or later. The advisory covered multiple newly listed flaws, including critical CVE-2026-76017 and high-severity CVE-2026-76018 through CVE-2026-76021.
The CVE record for CVE-2026-76034 was published, describing a critical WebGL buffer overflow in Chrome versions prior to 151.0.7922.169 that could enable remote code execution outside the browser sandbox via a crafted HTML page.
Google’s internal security team reported CVE-2026-76036, a critical buffer overflow vulnerability in Dawn, Chromium’s WebGPU implementation.
Google’s internal security team reported CVE-2026-76034, a critical buffer overflow vulnerability in Chrome’s WebGL component.
Google released a Chrome Stable channel update to version 151.0.7922.169/.170 for Windows and macOS and 151.0.7922.169 for Linux, fixing 15 security issues including the critical flaws CVE-2026-76034 and CVE-2026-76036. Google said rollout would occur gradually and withheld detailed bug information until most users install the fixes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
8 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcecybersecuritynews.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has released a Chrome desktop stable-channel update to address 15 security issues, including two **critical** buffer overflow vulnerabilities that could let a remote attacker achieve arbitrary code execution outside the browser sandbox through a crafted HTML page. The flaws are tracked as `CVE-2026-76034` in **WebGL** and `CVE-2026-76036` in **Dawn**, the graphics library that implements the **WebGPU** standard, raising the risk that a user could be compromised simply by visiting a malicious or compromised website. The update brings Chrome to version **151.0.7922.169/.170** on Windows and macOS and **151.0.7922.169** on Linux. The patched vulnerabilities affect desktop Chrome across all three platforms, and the presence of sandbox-escape-capable browser bugs makes the release particularly urgent because successful exploitation could move execution from browser content directly onto the host system.
Aug 19, 2026
Google Chrome patched two high-severity heap buffer overflow vulnerabilities, **`CVE-2026-5272`** in the browser's GPU component and **`CVE-2026-5275`** in **ANGLE**, that could allow **remote arbitrary code execution** if a user opened a crafted HTML page. Both flaws are classified as **`CWE-122`** and carry a **CVSS v3.1** rating of `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`, reflecting low attack complexity and high potential impact to confidentiality, integrity, and availability. The issues affect Google Chrome versions prior to **`146.0.7680.178`**, with impacted platforms listed across **Windows, Linux, and macOS**, while the ANGLE flaw was specifically described as affecting Chrome on Mac. The vulnerabilities were referenced in Google's Chrome stable channel advisory and Chromium issue tracker, underscoring the need for organizations to update browsers promptly to the patched release to reduce exposure to malicious web content.
Jun 29, 2026
Google has released a major Chrome Stable update that patches **151 security vulnerabilities**, including **22 critical flaws** affecting desktop builds on Windows, macOS, and Linux, with related fixes also noted for Android and iOS. The patched desktop versions are `148.0.7778.216/217` for Windows, `148.0.7778.215/216` for macOS, and `148.0.7778.215` for Linux. Google and national cyber authorities urged users and administrators to update immediately, while the company temporarily withheld detailed technical information until most users receive the fixes. Google said none of the newly disclosed critical issues were known to be exploited in the wild at disclosure time. The most serious bugs include **CVE-2026-9872** in the GPU process, **CVE-2026-9873** in Network, **CVE-2026-9874** in Dawn, and **CVE-2026-9875** in WebGL, alongside numerous flaws in **ANGLE**, Bluetooth, Base, Proxy, media, and other browser components. The vulnerabilities span use-after-free, out-of-bounds read and write, integer overflow, race condition, and insufficient validation weaknesses that could enable **remote code execution**, sandbox escape, data corruption, or broader system compromise through malicious web content. Google said many issues were found internally through fuzzing, sanitizers, and control-flow integrity tooling, while external researchers also reported multiple bugs through the bounty program, with rewards reaching **$43,000**.
Jun 29, 2026