Chromium: 25 Vulnerabilities Including Critical Flaws Patched in Single August 6th Disclosure
Chromium patched 25 vulnerabilities on August 6, 2026, including critical flaws in V8, Skia, and Media, with many allowing sandbox escapes.
Key findings
- 25 CVEs disclosed together for Chromium on August 6, 2026, including 3 Critical and 20 High severity flaws.
- Multiple use-after-free vulnerabilities across various components enable sandbox escapes and code execution.
- Critical flaws include integer overflows and out-of-bounds writes in V8 and other core components.
- All 25 vulnerabilities are fixed in Chrome 151.0.7922.109 (or 151.0.7922.108 for Linux).
- Low severity vulnerabilities allow for cross-origin data leakage.
On August 6, 2026, Google released an emergency update for its Chromium browser, patching a significant batch of 25 vulnerabilities. This coordinated disclosure event, spanning vulnerabilities with CVSS scores ranging from 3.1 (Low) to 9.6 (Critical), highlights ongoing memory safety challenges within the widely used browser. The vulnerabilities affect various components, including V8, Skia, Media, and UI elements, with many allowing for potential sandbox escapes and arbitrary code execution.
The disclosed vulnerabilities can be broadly categorized by their impact and the affected components:
Memory Corruption Vulnerabilities
A large number of the disclosed CVEs are related to memory corruption, specifically "use after free" and "out of bounds write" errors. These types of bugs are notoriously difficult to exploit but can lead to severe consequences such as sandbox escapes and arbitrary code execution.
- Use After Free: This class of vulnerability appears across numerous components, including UI (CVE-2026-19172, CVE-2026-19159, CVE-2026-19142), Media (CVE-2026-19171, CVE-2026-19163), Web Authentication (CVE-2026-19166), Extensions (CVE-2026-19165), Payments (CVE-2026-19155), Aura (CVE-2026-19149, CVE-2026-19147), and HTML (CVE-2026-19144). Exploitation often requires a remote attacker to craft a malicious HTML page or, in the case of extensions, trick a user into installing one.
- Out of Bounds Write: Vulnerabilities in Skia (CVE-2026-19173) and the GPU component on Linux (CVE-2026-19148) fall into this category, also potentially leading to sandbox escapes.
Input Validation and Integer Overflows
Several vulnerabilities stem from insufficient validation of untrusted input or integer overflows, which can also pave the way for code execution or sandbox escapes.
- Insufficient Validation: Flaws in UI (CVE-2026-19177), Contextual Tasks (CVE-2026-19169), Codecs (CVE-2026-19164), Workers (CVE-2026-19153), and Navigation (CVE-2026-19152) allow remote attackers to bypass security measures or achieve sandbox escapes.
- Integer Overflow: A critical vulnerability in V8 (CVE-2026-19174) and an inappropriate implementation in V8 (CVE-2026-19168) could allow remote attackers to execute arbitrary code within the sandbox.
Data Leakage
While most vulnerabilities pose a risk of code execution or sandbox escape, two low-severity vulnerabilities in Skia (CVE-2026-19161, CVE-2026-19160) are described as allowing for cross-origin data leakage.
The vulnerabilities were addressed in Google Chrome version 151.0.7922.109 for Windows and macOS, and 151.0.7922.108 for Linux. Google is rolling out this update gradually, and users are strongly advised to update their browsers as soon as possible to mitigate the risks associated with these critical security flaws. The sheer volume and severity of vulnerabilities patched in this single event underscore the importance of prompt patching and continuous security vigilance for users of the Chromium browser.
The disclosure of these 25 vulnerabilities on a single day highlights the effectiveness of coordinated vulnerability disclosure practices, allowing vendors to address multiple issues simultaneously. However, it also serves as a stark reminder of the complex and persistent security challenges inherent in developing and maintaining large-scale software projects like Chromium. Users should remain aware of ongoing security updates and ensure their browsers are kept up-to-date to protect against potential exploitation.