# Google Chrome 151 Update Fixes 41 Security Vulnerabilities, Including 6 Critical Flaws

> Google shipped Chrome 151.0.7922.108/.109 (Windows/macOS) and 151.0.7922.108 (Linux) on 2026-08-06, patching 41 vulnerabilities: 6 Chromium-designated Critical bugs (five use-after-free flaws in WebGL, Aura, Skia, and Views, plus one out-of-bounds write in ANGLE) and 35 High-severity issues. No in-the-wild exploitation was reported and none of the 41 CVEs appear in the CISA KEV catalog as of 2026-08-07.

- **Published:** 2026-08-07T00:00:00Z
- **Last reviewed:** 2026-08-09T21:25:26.903Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1931
- **ID:** TL-2026-1931
- **Severity:** CRITICAL (CVSS 9.6)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-19137, CVE-2026-19138, CVE-2026-19139, CVE-2026-19140, CVE-2026-19141, CVE-2026-19142, CVE-2026-19143, CVE-2026-19144, CVE-2026-19145, CVE-2026-19146, CVE-2026-19147, CVE-2026-19148, CVE-2026-19149, CVE-2026-19150, CVE-2026-19151, CVE-2026-19152, CVE-2026-19153, CVE-2026-19154, CVE-2026-19155, CVE-2026-19156, CVE-2026-19157, CVE-2026-19158, CVE-2026-19159, CVE-2026-19160, CVE-2026-19161, CVE-2026-19162, CVE-2026-19163, CVE-2026-19164, CVE-2026-19165, CVE-2026-19166, CVE-2026-19167, CVE-2026-19168, CVE-2026-19169, CVE-2026-19170, CVE-2026-19171, CVE-2026-19172, CVE-2026-19173, CVE-2026-19174, CVE-2026-19175, CVE-2026-19176, CVE-2026-19177

## Description

On 2026-08-06 Google published a Chrome 151 Stable Channel security update (151.0.7922.108/.109 for Windows and macOS, 151.0.7922.108 for Linux) resolving 41 CVEs: CVE-2026-19137 through CVE-2026-19177. Google's own severity classification splits the batch into 6 Critical and 35 High findings; roughly 12 of the 41 (~30%) were reported by external bug-bounty researchers rather than Google's internal security team, per Forbes reporting.

Direct NVD lookups on 16 of the 41 CVEs (the full Critical set plus 10 representative High-severity bugs) confirm the following: the six Critical bugs are CVE-2026-19137 (use-after-free, WebGL, CWE-416, CVSS 3.1 8.3, AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), CVE-2026-19149 (use-after-free, Aura, CWE-416, CVSS 3.1 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), CVE-2026-19154 (use-after-free, Skia, CWE-416, CVSS 3.1 8.3), CVE-2026-19157 (out-of-bounds write, ANGLE, CWE-787, no published CVSS metrics yet), CVE-2026-19170 (use-after-free, WebGL, CWE-416, CVSS 3.1 9.6 — externally reported by STAR Labs SG researchers Muhammad Alifa Ramdhan, Pan ZhenPeng, and Billy Jheng Bing Jhong), and CVE-2026-19172 (use-after-free, Views, CWE-416, CVSS 3.1 8.3). All six share the CVSS 3.1 Scope:Changed (S:C) property and NVD wording of 'potentially perform a sandbox escape via a crafted HTML page,' consistent with Chromium's standard two-process exploit-chain model: a first-stage bug (commonly in V8) achieves code execution inside the sandboxed renderer process, and a second-stage bug in a browser-process component (Aura, Views, Skia, GPU/ANGLE) escapes that sandbox.

Ten verified High-severity bugs flesh out the rest of the exploit surface. Two illustrate the likely first-stage half of the sandbox-escape chain: CVE-2026-19168 ('inappropriate implementation' in V8, CWE unspecified, CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reported via the XBOW automated bug-bounty platform) and CVE-2026-19174 (integer overflow in V8, CWE-190, CVSS 3.1 8.8), both described by NVD as allowing 'a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.' CVE-2026-19140 (use-after-free, GPU component, CWE-416, CVSS 3.1 8.3) and CVE-2026-19176 (use-after-free, Skia, CWE-416, CVSS 3.1 7.5) extend the same 'compromised renderer escalates via a second browser-process bug' pattern into the GPU process and a second, independent Skia bug distinct from the Critical CVE-2026-19154.

Two bugs depart from the passive drive-by pattern entirely. CVE-2026-19145 (use-after-free, Translate feature, CWE-416, CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) requires the victim to click a malicious link rather than merely load a page — Chrome's built-in page-translation pipeline is the trigger surface. CVE-2026-19156 (heap buffer overflow, Base, CWE-122, High) and CVE-2026-19165 (use-after-free, Extensions, CWE-416, CVSS 3.1 7.5) both require 'an attacker who convinced a user to install a malicious extension/Chrome Extension' — a social-engineering vector distinct from the URL-based bugs. CVE-2026-19143 (insufficient validation of untrusted input in WebAPKs, CWE-20, Chrome on Android, no NVD CVSS assigned yet) is a LOCAL-access bug: a local attacker escapes the sandbox via a malicious WebAPK file, a mechanism unique to the Android build. CVE-2026-19160 (uninitialized use, Skia, CWE-457, CVSS 3.1 3.1 LOW, AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) is likewise atypical in impact: it lets a compromised renderer 'leak cross-origin data via a crafted HTML page' — a confidentiality-only information-disclosure bug rather than a code-execution or availability issue, reflected in its low CVSS despite Chromium's internal High severity rating. CVE-2026-19177 (insufficient validation of untrusted input in UI, CVSS 3.1 8.3) follows the same 'compromised renderer + sandbox escape via crafted HTML page' pattern as the Critical bugs.

Beyond STAR Labs SG, Forbes and GBHackers name several additional external contributors to the 12 bug-bounty-sourced fixes: Sven Dysthe, Viktoria Zlatinova, Seunghyun Lee of QED Audit, and Fabian Wahle of Hap Security are credited for High-severity findings, and 'OpenAI Codex Security' is credited with an AI-assisted bug-bounty submission. Forbes' coverage frames this explicitly as an AI-vs-human-expertise story: a Google spokesperson emphasized 'the ongoing value of engaging with the external security research community,' while the article separately criticizes a rise in 'low-quality and unverified' AI-generated vulnerability reports flooding bug-bounty platforms — human triage and validation remain necessary even as AI tools (XBOW, Codex) contribute genuine finds like CVE-2026-19168.

Google 'restricted some bug report details' during the rollout window — a routine Chromium practice (reflected in several Chromium issue-tracker links returning limited public detail) intended to slow opportunistic patch-diffing and n-day exploit development before the update fully propagates, not an indicator of active exploitation. Cross-referencing all 41 CVE-2026-191xx identifiers against the CISA Known Exploited Vulnerabilities catalog (2026-08-07) returned no matches, and no source reviewed claims in-the-wild exploitation; a secondary source (radar.offseq.com) independently confirms 'no reports of these vulnerabilities being exploited in the wild at this time' and additionally characterizes the wider 41-bug batch as including race conditions and uninitialized-use defects alongside the use-after-free/overflow bugs already verified against NVD. NVD CVE text for several bugs (CVE-2026-19137, -19140, -19143, -19145, -19154, -19157, -19160, -19165, -19170, -19176) specifically describes 'Google Chrome prior to 151.0.7922.109,' indicating the same underlying components are shared across the Android build in addition to the Windows/macOS/Linux desktop channel named in the original hunt source; Google's release-note template appears to use '151.0.7922.109' as the boilerplate fixed-version string across per-CVE NVD descriptions even where the primary advisory lists 151.0.7922.108 as the Linux-specific build.

No network infrastructure, malware family, or C2 activity is associated with this disclosure — it is a defensive vendor patch bulletin, not an active campaign, so IOCs below are limited to affected software identifiers, credited research entities/tools, and the disclosed weakness classes rather than network indicators.

## MITRE ATT&CK

- T1588.006 Vulnerabilities
- T1588.005 Exploits
- T1587.004 Exploits
- T1203 Exploitation for Client Execution
- T1059.007 JavaScript
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1176 Software Extensions
- T1189 Drive-by Compromise
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Defense Evasion
- T1499.004 Endpoint Denial of Service

## Sources

- [Google Chrome 151 Update Fixes 41 Security Vulnerabilities](https://gbhackers.com/google-chrome-151-update-fixes-41-security-vulnerabilities/)
- [Google Chrome 151 Update: Bounty Hunters Discover 12 New Security Bugs](https://www.forbes.com/sites/daveywinder/2026/08/07/google-chrome-151-update-bounty-hunters-discover-12-new-security-bugs/)
- [Critical Vulnerabilities Patched With Chrome 151 Update](https://radar.offseq.com/threat/critical-vulnerabilities-patched-with-chrome-151-update-8b6bfa6c8606eb97)
- [Chrome Releases: Stable Channel Update for Desktop](https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html)
- [NVD - CVE-2026-19137 (Use-after-free, WebGL)](https://nvd.nist.gov/vuln/detail/CVE-2026-19137)
- [NVD - CVE-2026-19140 (Use-after-free, GPU)](https://nvd.nist.gov/vuln/detail/CVE-2026-19140)
- [NVD - CVE-2026-19143 (Improper input validation, WebAPKs/Android)](https://nvd.nist.gov/vuln/detail/CVE-2026-19143)
- [NVD - CVE-2026-19145 (Use-after-free, Translate)](https://nvd.nist.gov/vuln/detail/CVE-2026-19145)
- [NVD - CVE-2026-19149 (Use-after-free, Aura)](https://nvd.nist.gov/vuln/detail/CVE-2026-19149)
- [NVD - CVE-2026-19154 (Use-after-free, Skia)](https://nvd.nist.gov/vuln/detail/CVE-2026-19154)
- [NVD - CVE-2026-19156 (Heap buffer overflow, Base)](https://nvd.nist.gov/vuln/detail/CVE-2026-19156)
- [NVD - CVE-2026-19157 (Out-of-bounds write, ANGLE)](https://nvd.nist.gov/vuln/detail/CVE-2026-19157)
- [NVD - CVE-2026-19160 (Uninitialized use, Skia — cross-origin data leak)](https://nvd.nist.gov/vuln/detail/CVE-2026-19160)
- [NVD - CVE-2026-19165 (Use-after-free, Extensions)](https://nvd.nist.gov/vuln/detail/CVE-2026-19165)
- [NVD - CVE-2026-19168 (Inappropriate implementation, V8)](https://nvd.nist.gov/vuln/detail/CVE-2026-19168)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1931