Google Chrome 151 Update Fixes 41 Security Vulnerabilities, Including 6 Critical Flaws

Google Chrome 151 Update Fixes 41 Security Vulnerabilities (TL-2026-1931), also tracked as Chrome 151 Stable Channel Update, is a critical-severity software vulnerability scored CVSS 9.6, first published 2026-08-07 and last reviewed 2026-08-09. It has no confirmed attribution, affects Google Chrome (Windows), references 41 CVEs (CVE-2026-19137, CVE-2026-19138, CVE-2026-19139), maps to 12 MITRE ATT&CK techniques (T1059.007, T1068, T1176), and is covered by 9 detection rules and 34 indicators of compromise.

Key facts for TL-2026-1931

Threat ID
TL-2026-1931
Also known as
Chrome 151 Stable Channel Update
Severity
CRITICAL
CVSS
9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-08-07
Last reviewed
2026-08-09
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
all sectors browser end-users
Target regions
Global
Detection rules
9
Indicators of compromise
34
Updates
2026-08-09 · 3 updates · revalidated 3× · latest source

Malware and tooling in Google Chrome 151 Update Fixes 41 Security Vulnerabilities

Malware and tooling: Rakhni, XBOW

Google shipped Chrome 151.0.7922.108/.109 (Windows/macOS) and 151.0.7922.108 (Linux) on 2026-08-06, patching 41 vulnerabilities: 6 Chromium-designated Critical bugs (five use-after-free flaws in WebGL, Aura, Skia, and Views, plus one out-of-bounds write in ANGLE) and 35 High-severity issues. No in-the-wild exploitation was reported and none of the 41 CVEs appear in the CISA KEV catalog as of 2026-08-07.

How Google Chrome 151 Update Fixes 41 Security Vulnerabilities works

On 2026-08-06 Google published a Chrome 151 Stable Channel security update (151.0.7922.108/.109 for Windows and macOS, 151.0.7922.108 for Linux) resolving 41 CVEs: CVE-2026-19137 through CVE-2026-19177. Google's own severity classification splits the batch into 6 Critical and 35 High findings; roughly 12 of the 41 (~30%) were reported by external bug-bounty researchers rather than Google's internal security team, per Forbes reporting.

Direct NVD lookups on 16 of the 41 CVEs (the full Critical set plus 10 representative High-severity bugs) confirm the following: the six Critical bugs are CVE-2026-19137 (use-after-free, WebGL, CWE-416, CVSS 3.1 8.3, AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), CVE-2026-19149 (use-after-free, Aura, CWE-416, CVSS 3.1 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), CVE-2026-19154 (use-after-free, Skia, CWE-416, CVSS 3.1 8.3), CVE-2026-19157 (out-of-bounds write, ANGLE, CWE-787, no published CVSS metrics yet), CVE-2026-19170 (use-after-free, WebGL, CWE-416, CVSS 3.1 9.6 — externally reported by STAR Labs SG researchers Muhammad Alifa Ramdhan, Pan ZhenPeng, and Billy Jheng Bing Jhong), and CVE-2026-19172 (use-after-free, Views, CWE-416, CVSS 3.1 8.3). All six share the CVSS 3.1 Scope:Changed (S:C) property and NVD wording of 'potentially perform a sandbox escape via a crafted HTML page,' consistent with Chromium's standard two-process exploit-chain model: a first-stage bug (commonly in V8) achieves code execution inside the sandboxed renderer process, and a second-stage bug in a browser-process component (Aura, Views, Skia, GPU/ANGLE) escapes that sandbox.

Ten verified High-severity bugs flesh out the rest of the exploit surface. Two illustrate the likely first-stage half of the sandbox-escape chain: CVE-2026-19168 ('inappropriate implementation' in V8, CWE unspecified, CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reported via the XBOW automated bug-bounty platform) and CVE-2026-19174 (integer overflow in V8, CWE-190, CVSS 3.1 8.8), both described by NVD as allowing 'a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.' CVE-2026-19140 (use-after-free, GPU component, CWE-416, CVSS 3.1 8.3) and CVE-2026-19176 (use-after-free, Skia, CWE-416, CVSS 3.1 7.5) extend the same 'compromised renderer escalates via a second browser-process bug' pattern into the GPU process and a second, independent Skia bug distinct from the Critical CVE-2026-19154.

Two bugs depart from the passive drive-by pattern entirely. CVE-2026-19145 (use-after-free, Translate feature, CWE-416, CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) requires the victim to click a malicious link rather than merely load a page — Chrome's built-in page-translation pipeline is the trigger surface. CVE-2026-19156 (heap buffer overflow, Base, CWE-122, High) and CVE-2026-19165 (use-after-free, Extensions, CWE-416, CVSS 3.1 7.5) both require 'an attacker who convinced a user to install a malicious extension/Chrome Extension' — a social-engineering vector distinct from the URL-based bugs. CVE-2026-19143 (insufficient validation of untrusted input in WebAPKs, CWE-20, Chrome on Android, no NVD CVSS assigned yet) is a LOCAL-access bug: a local attacker escapes the sandbox via a malicious WebAPK file, a mechanism unique to the Android build. CVE-2026-19160 (uninitialized use, Skia, CWE-457, CVSS 3.1 3.1 LOW, AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) is likewise atypical in impact: it lets a compromised renderer 'leak cross-origin data via a crafted HTML page' — a confidentiality-only information-disclosure bug rather than a code-execution or availability issue, reflected in its low CVSS despite Chromium's internal High severity rating. CVE-2026-19177 (insufficient validation of untrusted input in UI, CVSS 3.1 8.3) follows the same 'compromised renderer + sandbox escape via crafted HTML page' pattern as the Critical bugs.

Beyond STAR Labs SG, Forbes and GBHackers name several additional external contributors to the 12 bug-bounty-sourced fixes: Sven Dysthe, Viktoria Zlatinova, Seunghyun Lee of QED Audit, and Fabian Wahle of Hap Security are credited for High-severity findings, and 'OpenAI Codex Security' is credited with an AI-assisted bug-bounty submission. Forbes' coverage frames this explicitly as an AI-vs-human-expertise story: a Google spokesperson emphasized 'the ongoing value of engaging with the external security research community,' while the article separately criticizes a rise in 'low-quality and unverified' AI-generated vulnerability reports flooding bug-bounty platforms — human triage and validation remain necessary even as AI tools (XBOW, Codex) contribute genuine finds like CVE-2026-19168.

Google 'restricted some bug report details' during the rollout window — a routine Chromium practice (reflected in several Chromium issue-tracker links returning limited public detail) intended to slow opportunistic patch-diffing and n-day exploit development before the update fully propagates, not an indicator of active exploitation. Cross-referencing all 41 CVE-2026-191xx identifiers against the CISA Known Exploited Vulnerabilities catalog (2026-08-07) returned no matches, and no source reviewed claims in-the-wild exploitation; a secondary source (radar.offseq.com) independently confirms 'no reports of these vulnerabilities being exploited in the wild at this time' and additionally characterizes the wider 41-bug batch as including race conditions and uninitialized-use defects alongside the use-after-free/overflow bugs already verified against NVD. NVD CVE text for several bugs (CVE-2026-19137, -19140, -19143, -19145, -19154, -19157, -19160, -19165, -19170, -19176) specifically describes 'Google Chrome prior to 151.0.7922.109,' indicating the same underlying components are shared across the Android build in addition to the Windows/macOS/Linux desktop channel named in the original hunt source; Google's release-note template appears to use '151.0.7922.109' as the boilerplate fixed-version string across per-CVE NVD descriptions even where the primary advisory lists 151.0.7922.108 as the Linux-specific build.

No network infrastructure, malware family, or C2 activity is associated with this disclosure — it is a defensive vendor patch bulletin, not an active campaign, so IOCs below are limited to affected software identifiers, credited research entities/tools, and the disclosed weakness classes rather than network indicators.

MITRE ATT&CK techniques used in TL-2026-1931

Execution

T1059.007 JavaScript; T1203 Exploitation for Client Execution; T1204.001 Malicious Link; T1204.002 Malicious File

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Persistence

T1176 Software Extensions

Initial Access

T1189 Drive-by Compromise

Defense Evasion

T1211 Exploitation for Defense Evasion

Impact

T1499.004 Endpoint Denial of Service

Resource Development

T1587.004 Exploits; T1588.005 Exploits; T1588.006 Vulnerabilities

Affected products and versions in Google Chrome 151 Update Fixes 41 Security Vulnerabilities

  • Google — Chrome (Windows)
    Vulnerable versions: prior to 151.0.7922.108
    Fixed in: 151.0.7922.108; 151.0.7922.109
  • Google — Chrome (macOS)
    Vulnerable versions: prior to 151.0.7922.109
    Fixed in: 151.0.7922.108; 151.0.7922.109
  • Google — Chrome (Linux)
    Vulnerable versions: prior to 151.0.7922.108
    Fixed in: 151.0.7922.108
  • Google — Chrome (Android)
    Vulnerable versions: prior to 151.0.7922.109
    Fixed in: 151.0.7922.109

Remediation for Google Chrome 151 Update Fixes 41 Security Vulnerabilities

Patches

  • Chrome 151.0.7922.108/.109 (Windows, macOS)
  • Chrome 151.0.7922.108 (Linux)
  • Chrome 151.0.7922.109 (Android)

Immediate actions

  • Update Google Chrome to 151.0.7922.108/.109 (Windows/macOS) or 151.0.7922.108 (Linux) via chrome://settings/help
  • Restart the browser after update to force reload of the patched renderer/GPU-process binaries
  • For managed fleets, verify ChromeOS/Chrome Browser Enterprise policy is pushing 151.0.7922.108/.109 rather than pinning an older version

Longer-term hardening

  • Enable Chrome auto-update and enterprise policy-based forced updates to shrink the patch-gap exploitation window
  • Deploy Chrome Enterprise extension allow-listing / ExtensionInstallBlocklist policy to mitigate the CVE-2026-19156/CVE-2026-19165 malicious-extension vector
  • Restrict or monitor Android WebAPK installation from untrusted sources to mitigate the CVE-2026-19143 local sandbox-escape vector
  • Maintain browser isolation or site-isolation hardening for high-risk user segments given the recurring sandbox-escape pattern across WebGL/Aura/Skia/Views/ANGLE/GPU

CVEs associated with Google Chrome 151 Update Fixes 41 Security Vulnerabilities

  • CVE-2026-19137
  • CVE-2026-19138
  • CVE-2026-19139
  • CVE-2026-19140
  • CVE-2026-19141
  • CVE-2026-19142
  • CVE-2026-19143
  • CVE-2026-19144
  • CVE-2026-19145
  • CVE-2026-19146
  • CVE-2026-19147
  • CVE-2026-19148
  • CVE-2026-19149
  • CVE-2026-19150
  • CVE-2026-19151
  • CVE-2026-19152
  • CVE-2026-19153
  • CVE-2026-19154
  • CVE-2026-19155
  • CVE-2026-19156
  • CVE-2026-19157
  • CVE-2026-19158
  • CVE-2026-19159
  • CVE-2026-19160
  • CVE-2026-19161
  • CVE-2026-19162
  • CVE-2026-19163
  • CVE-2026-19164
  • CVE-2026-19165
  • CVE-2026-19166
  • CVE-2026-19167
  • CVE-2026-19168
  • CVE-2026-19169
  • CVE-2026-19170
  • CVE-2026-19171
  • CVE-2026-19172
  • CVE-2026-19173
  • CVE-2026-19174
  • CVE-2026-19175
  • CVE-2026-19176
  • CVE-2026-19177

Weaknesses (CWE) in Google Chrome 151 Update Fixes 41 Security Vulnerabilities

CWE-416, CWE-787, CWE-190, CWE-122, CWE-457, CWE-20, CWE-693

Timeline of Google Chrome 151 Update Fixes 41 Security Vulnerabilities

  • Google restricted public access to several Chromium issue-tracker entries for the newly disclosed bugs during the rollout window, a standard defensive measure to slow patch-diff reverse-engineering and n-day exploit development.
  • Google stated the update would roll out to the Stable channel population 'over the next several days and weeks.'
  • NVD published CVE records for the Chrome 151 fixes, including all 6 Chromium-designated Critical bugs (CVE-2026-19137, -19149, -19154, -19157, -19170, -19172).
  • Google published the Chrome 151 Stable Channel security update on the Chrome Releases blog: 151.0.7922.108/.109 for Windows and macOS, 151.0.7922.108 for Linux, fixing 41 CVEs (CVE-2026-19137 through CVE-2026-19177).
  • Forbes reported researcher Sven Dysthe received a $5,000 bounty for CVE-2026-19169 (insufficient input validation, Contextual Tasks) — the only disclosed bounty amount besides two separate $500 awards for WebGL findings.
  • GitHub Advisory Database (GHSA-w3c4-94r5-cpv4 / CVE-2026-19142) and Ubuntu Security Notices (CVE-2026-19159) independently corroborated a second, UI-gesture-dependent Views use-after-free pattern distinct from the passive drive-by pattern of the six Critical bugs.
  • SecurityWeek published 'Critical Vulnerabilities Patched With Chrome 151 Update,' independently corroborating the 6 Critical / 35 High-severity split with no in-the-wild exploitation reported.
  • HKCERT published a companion security bulletin, 'Google Chrome Multiple Vulnerabilities' (20260807), corroborating GovCERT.HK's advisory.
  • GovCERT.HK published Security Alert A26-08-09, warning that a remote attacker could exploit the Chrome 151 flaws via a specially crafted web page for RCE, DoS, elevation of privilege, information disclosure, or security-restriction bypass/tampering.
  • Extended NVD verification against 6 additional CVE-2026-191xx records (CVE-2026-19140, -19143, -19145, -19160, -19165, -19176) confirmed further use-after-free bugs in the GPU and Skia components, a use-after-free in the Translate feature triggered by a malicious link click (rather than passive page load), an Android-specific local WebAPK sandbox-escape bug (CWE-20), and a confidentiality-only cross-origin data leak caused by uninitialized memory use in Skia (CWE-457).
  • Cross-referenced all 41 CVE-2026-191xx identifiers against the CISA Known Exploited Vulnerabilities catalog; none were present, consistent with the absence of any confirmed in-the-wild exploitation reporting.
  • Forbes published follow-up coverage noting roughly 12 of the 41 fixes (~30%) originated from external bug-bounty researchers rather than Google's internal team, naming Sven Dysthe, Seunghyun Lee (QED Audit), Fabian Wahle (Hap Security), and the STAR Labs SG team (Muhammad Alifa Ramdhan, Pan ZhenPeng, Billy Jheng Bing Jhong), and framing the release as an AI-vs-human-expertise story in vulnerability research.
  • GBHackers published coverage of the Chrome 151 update (the hunt source article for this threat record), naming researchers Viktoria Zlatinova, OpenAI Codex Security, and XBOW.

Update history for TL-2026-1931

Sources cited for Google Chrome 151 Update Fixes 41 Security Vulnerabilities

Threats related to Google Chrome 151 Update Fixes 41 Security Vulnerabilities

Detection coverage for TL-2026-1931

As of 2026-08-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1931 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats