Loading story…
Google has released Chrome 151 Stable for Windows, macOS, and Linux, fixing seven security vulnerabilities including CVE-2026-76017, a critical use-after-free flaw in Chromoting, the technology behind Chrome Remote Desktop. The update is rolling out as 151.0.7922.173/.174 for Windows and macOS and 151.0.7922.173 for Linux, with Google limiting technical details until more users have installed the patch.
The release also addresses six high-severity bugs across Import, Workers, V8, DOM, Network, and Linux Toolkit Theming, covering weakness types such as privilege elevation, incorrect authorization, race conditions, buffer overflow, and improper resource control. Google said it has not disclosed proof-of-concept exploit code or reported active exploitation, but the flaws could still expose users to compromise through malicious web content, phishing links, advertisements, or other crafted browser-based attacks, making prompt enterprise patching a priority.
See real exploitation activity before you spend the cycle.
10 events from the most recent confirmed update back to the earliest known activity.
Debian LTS issued DLA-4758-1 for Debian 12 "Bookworm," updating Chromium to 151.0.7922.173-1~deb12u1 to remediate CVE-2026-76017 through CVE-2026-76023. The advisory recommended upgrading affected Chromium packages.
Debian issued DSA-6476-1 for Debian 13 "trixie," updating Chromium to 151.0.7922.173-1~deb13u1 to fix CVE-2026-76017 through CVE-2026-76023. Debian recommended upgrading affected Chromium packages.
Google released a Chrome Stable channel update to version 151.0.7922.173/.174 for Windows and Mac and 151.0.7922.173 for Linux, fixing seven vulnerabilities including critical CVE-2026-76017. Google said detailed bug information may remain restricted until most users have updated or dependent third-party libraries are patched.
Keita Sode and Daisuke Hatakeyama of SYZD Research reported CVE-2026-76023, a high-severity improper resource control vulnerability in Linux Toolkit Theming.
0xAlessandro reported CVE-2026-76022, a high-severity buffer overflow vulnerability in Chrome's Network component.
Salvatore Gulizia, also known as Serotav, reported CVE-2026-76020, a high-severity race condition vulnerability in Chrome's V8 JavaScript engine.
Google BigSleep@Grape reported CVE-2026-76021, a high-severity use-after-free vulnerability in Chrome's DOM component.
An anonymous reporter disclosed CVE-2026-76019, a high-severity incorrect authorization vulnerability in Chrome Workers.
Google internally reported CVE-2026-76017, a critical use-after-free vulnerability in Chromoting, the technology behind Chrome Remote Desktop.
Google reported CVE-2026-76018, a high-severity privilege elevation vulnerability in the Import component of Chrome.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
8 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcetenable.com
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourceacn.gov.it
Open sourcecybersecuritynews.com
Open sourcechromereleases.googleblog.com
Open sourcecirt.gy
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released a Chrome Stable channel update to fix **33 vulnerabilities**, including **seven Critical flaws** that could allow **remote code execution** if a user visits a malicious webpage. The update moves Chrome to **`149.0.7827.155/.156`** on Windows and macOS and **`149.0.7827.155`** on Linux, with Google rolling it out gradually. The most serious issues are largely **use-after-free** memory corruption bugs affecting components including **WebShare**, **Digital Credentials**, **File Input**, **Passwords**, and **Web Authentication**. Named issues include **`CVE-2026-12437`** in WebShare, **`CVE-2026-12439`** and **`CVE-2026-12440`** in Digital Credentials, **`CVE-2026-12442`** in Passwords, and **`CVE-2026-12443`** in Web Authentication. Google also patched High-severity flaws in **WebRTC, Extensions, Safe Browsing, GPU, File System Access, Media, Downloads,** and the **Tab Strip**, with risks ranging from data leakage and heap corruption to sandbox escape and exploit chaining. The company said technical details will remain limited until more users update and urged users and enterprises to install the patch and relaunch Chrome promptly.
Jul 12, 2026
Google released Chrome 151 Stable for desktop to address a large set of security issues, including **seven critical vulnerabilities** and hundreds of additional flaws across core browser components. The update brings Chrome to `151.0.7922.71/.72` on Windows and macOS and `151.0.7922.71` on Linux, and fixes weaknesses in areas including Compositing, Dawn, Views, Skia, Updater, ANGLE, Ozone, V8, WebGL, Media, and Chrome for iOS. Reported impacts include arbitrary code execution, sandbox escape, privilege escalation, information disclosure, data corruption, and bypass of security restrictions. The critical issues, tracked as `CVE-2026-17650` through `CVE-2026-17656`, include use-after-free bugs, a race condition, and insufficient validation of untrusted input. Google said the release contains **370 security fixes** overall, while public advisories highlighted 78 newly identified vulnerabilities, including 71 rated high severity, and noted that detailed bug information will remain temporarily restricted until most users are patched or dependent third-party fixes are available. Enterprises and users are being urged to update supported Chrome installations promptly as the rollout proceeds over days and weeks.
Aug 11, 2026
Google has released a major Chrome Stable update that patches **151 security vulnerabilities**, including **22 critical flaws** affecting desktop builds on Windows, macOS, and Linux, with related fixes also noted for Android and iOS. The patched desktop versions are `148.0.7778.216/217` for Windows, `148.0.7778.215/216` for macOS, and `148.0.7778.215` for Linux. Google and national cyber authorities urged users and administrators to update immediately, while the company temporarily withheld detailed technical information until most users receive the fixes. Google said none of the newly disclosed critical issues were known to be exploited in the wild at disclosure time. The most serious bugs include **CVE-2026-9872** in the GPU process, **CVE-2026-9873** in Network, **CVE-2026-9874** in Dawn, and **CVE-2026-9875** in WebGL, alongside numerous flaws in **ANGLE**, Bluetooth, Base, Proxy, media, and other browser components. The vulnerabilities span use-after-free, out-of-bounds read and write, integer overflow, race condition, and insufficient validation weaknesses that could enable **remote code execution**, sandbox escape, data corruption, or broader system compromise through malicious web content. Google said many issues were found internally through fuzzing, sanitizers, and control-flow integrity tooling, while external researchers also reported multiple bugs through the bounty program, with rewards reaching **$43,000**.
Jun 29, 2026