Google Chrome 151 Update Fixes 41 Security Vulnerabilities, Including 6 Critical Flaws — Threadlinqs Intelligence
As of 2026-08-09, Google Chrome 151 Update Fixes 41 Security Vulnerabilities, Including 6 Critical Flaws is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 34 indicators of compromise.
Threat ID: TL-2026-1931 · Severity: CRITICAL · CVSS: 9.6 · Status: PATCHED · Category: VULNERABILITY
Updated: 2026-08-09 · 3 updates · revalidated 3× · latest source
Google shipped Chrome 151.0.7922.108/.109 (Windows/macOS) and 151.0.7922.108 (Linux) on 2026-08-06, patching 41 vulnerabilities: 6 Chromium-designated Critical bugs (five use-after-free flaws in
On 2026-08-06 Google published a Chrome 151 Stable Channel security update (151.0.7922.108/.109 for Windows and macOS, 151.0.7922.108 for Linux) resolving 41 CVEs: CVE-2026-19137 through CVE-2026-19177. Google's own severity classification splits the batch into 6 Critical and 35 High findings; roughly 12 of the 41 (~30%) were reported by external bug-bounty researchers rather than Google's internal security team, per Forbes reporting.
Direct NVD lookups on 16 of the 41 CVEs (the full Critical set plus 10 representative High-severity bugs) confirm the following: the six Critical bugs are CVE-2026-19137 (use-after-free, WebGL, CWE-416, CVSS 3.1 8.3, AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), CVE-2026-19149 (use-after-free, Aura, CWE-416, CVSS 3.1 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), CVE-2026-19154 (use-after-free, Skia, CWE-416, CVSS 3.1 8.3), CVE-2026-19157 (out-of-bounds write, ANGLE, CWE-787, no published CVSS metrics yet), CVE-2026-19170 (use-after-free, WebGL, CWE-416, CVSS 3.1 9.6 — externally reported by STAR Labs SG researchers Muhammad Alifa Ramdhan, Pan ZhenPeng, and Billy Jheng Bing Jhong), and CVE-2026-19172 (use-after-free, Views, CWE-416, CVSS 3.1 8.3). All six share the CVSS 3.1 Scope:Changed (S:C) property and NVD wording of 'potentially perform a sandbox escape via a crafted HTML page,' consistent with Chromium's standard two-process exploit-chain model: a first-stage bug (commonly in V8) achieves code execution inside the sandboxed renderer process, and a second-stage bug in a browser-process component (Aura, Views, Skia, GPU/ANGLE) escapes that sandbox.
Ten verified High-severity bugs flesh out the rest of the exploit surface. Two illustrate the likely first-stage half of the sandbox-escape chain: CVE-2026-19168 ('inappropriate implementation' in V8, CWE unspecified, CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reported via the XBOW automated bug-bounty platform) and CVE-2026-19174 (integer overflow in V8, CWE-190, CVSS 3.1 8.8), both described by NVD as allowing 'a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.' CVE-2026-19140 (use-after-free, GPU component, CWE-416, CVSS 3.1 8.3) and CVE-2026-19176 (use-after-free, Skia, CWE-416, CVSS 3.1 7.5) extend the same 'compromised renderer escalates via a second browser-process bug' pattern into the GPU process and a second, independent Skia bug distinct from the Critical CVE-2026-19154.
Two bugs depart from the passive drive-by pattern entirely. CVE-2026-19145 (use-after-free, Translate feature, CWE-416, CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) requires the victim to click a malicious link rather than merely load a page — Chrome's built-in page-translation pipeline is the trigger surface. CVE-2026-19156 (heap buffer overflow, Base, CWE-122, High) and CVE-2026-19165 (use-after-free, Extensions, CWE-416, CVSS 3.1 7.5) both require 'an attacker who convinced a user to install a malicious extension/Chrome Extension' — a social-engineering vector distinct from the URL-based bugs. CVE-2026-19143 (insufficient validation of untrusted input in WebAPKs, CWE-20, Chrome on Android, no NVD CVSS assigned yet) is a LOCAL-access bug: a local attacker escapes the sandbox via a malicious WebAPK file, a mechanism unique to the Android build. CVE-2026-19160 (uninitialized use, Skia, CWE-457, CVSS 3.1 3.1 LOW, AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) is likewise atypical in impact: it lets a compromised renderer 'leak cross-origin data via a crafted HTML page' — a confidentiality-only information-disclosure bug rather than a code-execution or availability issue, reflected in its low CVSS despite Chromium's internal High severity rating. CVE-2026-19177 (insufficient validation of untrusted input in UI, CVSS 3.1 8.3) follows the same 'compromised renderer + sandbox escape via crafted HTML page' pattern as the Critical bugs.
Beyond STAR Labs SG, Forbes and GBHackers name several additional external contributors to the 12 bug-bounty-sou
Weaknesses (CWE)
CWE-416, CWE-787, CWE-190, CWE-122, CWE-457, CWE-20, CWE-693
Target sectors: all sectors browser end-users
Target regions: Global
Timeline
- Google published the Chrome 151 Stable Channel security update on the Chrome Releases blog: 151.0.7922.108/.109 for Windows and macOS, 151.0.7922.108 for Linux, fixing 41 CVEs (CVE-2026-19137 through CVE-2026-19177).
- NVD published CVE records for the Chrome 151 fixes, including all 6 Chromium-designated Critical bugs (CVE-2026-19137, -19149, -19154, -19157, -19170, -19172).
- Google stated the update would roll out to the Stable channel population 'over the next several days and weeks.'
- Google restricted public access to several Chromium issue-tracker entries for the newly disclosed bugs during the rollout window, a standard defensive measure to slow patch-diff reverse-engineering and n-day exploit development.
- GBHackers published coverage of the Chrome 151 update (the hunt source article for this threat record), naming researchers Viktoria Zlatinova, OpenAI Codex Security, and XBOW.
- Forbes published follow-up coverage noting roughly 12 of the 41 fixes (~30%) originated from external bug-bounty researchers rather than Google's internal team, naming Sven Dysthe, Seunghyun Lee (QED Audit), Fabian Wahle (Hap Security), and the STAR Labs SG team (Muhammad Alifa Ramdhan, Pan ZhenPeng, Billy Jheng Bing Jhong), and framing the release as an AI-vs-human-expertise story in vulnerability research.
- Cross-referenced all 41 CVE-2026-191xx identifiers against the CISA Known Exploited Vulnerabilities catalog; none were present, consistent with the absence of any confirmed in-the-wild exploitation reporting.
- Extended NVD verification against 6 additional CVE-2026-191xx records (CVE-2026-19140, -19143, -19145, -19160, -19165, -19176) confirmed further use-after-free bugs in the GPU and Skia components, a use-after-free in the Translate feature triggered by a malicious link click (rather than passive page load), an Android-specific local WebAPK sandbox-escape bug (CWE-20), and a confidentiality-only cross-origin data leak caused by uninitialized memory use in Skia (CWE-457).
- GovCERT.HK published Security Alert A26-08-09, warning that a remote attacker could exploit the Chrome 151 flaws via a specially crafted web page for RCE, DoS, elevation of privilege, information disclosure, or security-restriction bypass/tampering.
- HKCERT published a companion security bulletin, 'Google Chrome Multiple Vulnerabilities' (20260807), corroborating GovCERT.HK's advisory.
- SecurityWeek published 'Critical Vulnerabilities Patched With Chrome 151 Update,' independently corroborating the 6 Critical / 35 High-severity split with no in-the-wild exploitation reported.
- GitHub Advisory Database (GHSA-w3c4-94r5-cpv4 / CVE-2026-19142) and Ubuntu Security Notices (CVE-2026-19159) independently corroborated a second, UI-gesture-dependent Views use-after-free pattern distinct from the passive drive-by pattern of the six Critical bugs.
Update History
- 2026-08-09 — Chrome 151 Update Patches 41 Vulnerabilities, Including 6 Critical Memory-Corruption Flaws: What changed No severity/exploitability/status escalation — remains CRITICAL / THEORETICAL / PATCHED. New: independent verification of a distinct UI-gesture-dependent Views use-after-free pattern (CVE-2026-19142, CVE-2026-19159) via GitHub
- 2026-08-09 — Multiple Vulnerabilities in Google Chrome (Chrome 151.0.7922.108) — 41 Flaws Including 6 Critical Use-After-Free/Out-of-Bounds Write Bugs: What changed No change to severity, exploitability, or CVSS (still CRITICAL / THEORETICAL / 9.6). The newer report's 'ACTIVE' status value was NOT applied — it would downgrade the existing verified PATCHED status without supporting evidence
- 2026-08-09 — Chrome 151 Patches 41 Vulnerabilities Including 6 Critical Use-After-Free / Out-of-Bounds Write Flaws (CVE-2026-19137, -19149, -19154, -19157, -19170, -19172): What changed No change to severity, exploitability, or status (CRITICAL / THEORETICAL / PATCHED, CVSS 9.6 unchanged) — this report contributes attribution/provenance detail only, not a threat escalation. New indicators (3) 2 newly named res
References
- Google Chrome 151 Update Fixes 41 Security Vulnerabilities
- Google Chrome 151 Update: Bounty Hunters Discover 12 New Security Bugs
- Critical Vulnerabilities Patched With Chrome 151 Update
- Chrome Releases: Stable Channel Update for Desktop
- NVD - CVE-2026-19137 (Use-after-free, WebGL)
- NVD - CVE-2026-19140 (Use-after-free, GPU)
- NVD - CVE-2026-19143 (Improper input validation, WebAPKs/Android)
- NVD - CVE-2026-19145 (Use-after-free, Translate)
- NVD - CVE-2026-19149 (Use-after-free, Aura)
- NVD - CVE-2026-19154 (Use-after-free, Skia)
- NVD - CVE-2026-19156 (Heap buffer overflow, Base)
- NVD - CVE-2026-19157 (Out-of-bounds write, ANGLE)
- NVD - CVE-2026-19160 (Uninitialized use, Skia — cross-origin data leak)
- NVD - CVE-2026-19165 (Use-after-free, Extensions)
- NVD - CVE-2026-19168 (Inappropriate implementation, V8)
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 34 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-19137, CVE-2026-19138, CVE-2026-19139, CVE-2026-19140, CVE-2026-19141, CVE-2026-19142, CVE-2026-19143, CVE-2026-19144, CVE-2026-19145, CVE-2026-19146, T1588.006, T1588.005, T1587.004, T1203, T1059.007, T1204.001, T1204.002, T1176, T1189, T1068
