Google has released a new Chrome Stable Channel update for desktop that addresses 41 security vulnerabilities, including six critical memory-safety flaws affecting WebGL, Aura, Skia, ANGLE, and Views.
The update advances Chrome to version 151.0.7922.108/.109 on Windows and macOS, and 151.0.7922.108 on Linux.
The six critical vulnerabilities are tracked as CVE-2026-19137, CVE-2026-19149, CVE-2026-19154, CVE-2026-19157, CVE-2026-19170, and CVE-2026-19172.
Chrome 151 Fixes Critical Flaws
Five are use-after-free (UAF) defects, while one, CVE-2026-19157, is an out-of-bounds write affecting ANGLE, Chrome’s graphics translation layer. Use-after-free vulnerabilities occur when software continues to access memory after it has been released.
In browser attack chains, such flaws can potentially be exploited through crafted web content to corrupt memory, crash a renderer, disclose information, or, in certain conditions, achieve code execution.
The affected WebGL, Skia, ANGLE, and UI components are particularly significant because they handle graphics rendering and user interface operations exposed to web content.
Two of the critical defects reside in WebGL: CVE-2026-19137, reported anonymously, and CVE-2026-19170, reported by Muhammad Alifa Ramdhan, Pan ZhenPeng, and Billy Jheng Bing Jhong of STAR Labs SG.
Google also fixed critical UAF flaws in Aura, Skia, and Views. Aura and Views are central parts of Chrome’s cross-platform interface stack, while Skia is the browser’s graphics engine.
Beyond the critical issues, the release remediates 35 high-severity vulnerabilities. These include additional UAF bugs across GPU, HTML, V8, Media, Payments, Extensions, Web Authentication, and Skia.
| CVE ID | Severity | Vulnerability Type | Component | Reporter |
|---|---|---|---|---|
| CVE-2026-19137 | Critical | Use after free | WebGL | Anonymous |
| CVE-2026-19149 | Critical | Use after free | Aura | |
| CVE-2026-19154 | Critical | Use after free | Skia | |
| CVE-2026-19157 | Critical | Out of bounds write | ANGLE | |
| CVE-2026-19170 | Critical | Use after free | WebGL | STAR Labs SG (Muhammad Alifa Ramdhan, Pan ZhenPeng, Billy Jheng Bing Jhong) |
| CVE-2026-19172 | Critical | Use after free | Views | |
| CVE-2026-19169 | High | Insufficient validation of untrusted input | Contextual Tasks | Sven Dysthe (@svn-dys) |
| CVE-2026-19168 | High | Inappropriate implementation | V8 | XBOW / Andrés Luksenberg |
| CVE-2026-19138 | High | Heap buffer overflow | CrashReporting | |
| CVE-2026-19139 | High | Race | CredentialProvider | |
| CVE-2026-19140 | High | Use after free | GPU | |
| CVE-2026-19141 | High | Use after free | Resources | |
| CVE-2026-19142 | High | Use after free | Views | |
| CVE-2026-19143 | High | Insufficient validation of untrusted input | WebAPKs | |
| CVE-2026-19144 | High | Use after free | HTML | |
| CVE-2026-19145 | High | Use after free | Translate | |
| CVE-2026-19146 | High | Uninitialized use | GPU | |
| CVE-2026-19147 | High | Use after free | Aura | |
| CVE-2026-19148 | High | Out of bounds write | GPU | |
| CVE-2026-19150 | High | Inappropriate implementation | V8 | |
| CVE-2026-19151 | High | Use after free | V8 | |
| CVE-2026-19152 | High | Inappropriate implementation | Navigation | |
| CVE-2026-19153 | High | Insufficient validation of untrusted input | Workers | |
| CVE-2026-19155 | High | Use after free | Payments | |
| CVE-2026-19156 | High | Heap buffer overflow | Base | Viktoria Zlatinova |
| CVE-2026-19158 | High | Use after free | Views | |
| CVE-2026-19159 | High | Use after free | Views | |
| CVE-2026-19160 | High | Uninitialized use | Skia | |
| CVE-2026-19161 | High | Uninitialized use | Skia | |
| CVE-2026-19162 | High | Out of bounds write | V8 | OpenAI Codex Security (amyb) |
| CVE-2026-19163 | High | Use after free | Media | |
| CVE-2026-19164 | High | Insufficient validation of untrusted input | Codecs | |
| CVE-2026-19165 | High | Use after free | Extensions | @bean5oup |
| CVE-2026-19166 | High | Use after free | Web Authentication | heesun |
| CVE-2026-19167 | High | Integer overflow | GPU | |
| CVE-2026-19171 | High | Use after free | Media | |
| CVE-2026-19173 | High | Out of bounds write | Skia | Vu Van Tien (@n0_Be3r) |
| CVE-2026-19174 | High | Integer overflow | V8 | Seunghyun Lee (@0x10n), QED Audit |
| CVE-2026-19175 | High | Use after free | Payments | |
| CVE-2026-19176 | High | Use after free | Skia | WinD39 – Huynh Dinh Vu |
| CVE-2026-19177 | High | Insufficient validation of untrusted input | UI | Fabian Wahle (Hap Security) |
The update also corrects heap-buffer overflows, uninitialized-use issues, integer overflows, race conditions, and insufficient validation of untrusted input in components including Contextual Tasks, WebAPKs, Workers, Codecs, and the browser UI.
Notably, CVE-2026-19162 is an out-of-bounds write in V8, Chrome’s JavaScript and WebAssembly engine.
Although rated High rather than Critical, memory-corruption bugs in V8 remain valuable targets for threat actors because they can be triggered by malicious JavaScript delivered via a website. CVE-2026-19173, another high-severity out-of-bounds write, affects Skia.
Google has restricted detailed bug information for many issues until a sufficient proportion of users have received the update, a standard measure intended to reduce the risk of opportunistic exploitation during the patch-adoption window.
According to Google, organizations should prioritize deployment via enterprise update management platforms, verify that managed endpoints are running Chrome 151.0.7922.108 or later, and ensure users restart their browsers after the update is downloaded.
Security teams should also monitor browser version compliance on endpoints that routinely access sensitive web applications or process privileged workflows.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
