Chromium: Six High-Severity Vulnerabilities Patched in Single-Day Disclosure
Chromium patched six vulnerabilities on August 18, 2026, including High-severity flaws in V8, USB, and other components, allowing potential code execution.
Key findings
- Six vulnerabilities in Chromium disclosed on August 18, 2026, with High and Medium severity ratings.
- Flaws affect key components including V8, USB, and CredentialProvider, enabling code execution and sandbox escapes.
- Vulnerabilities include use-after-free, race conditions, type confusion, and incorrect calculations.
- Patched in Chrome version 151.0.7922.169/.170, users urged to update promptly.
On August 18, 2026, Google released a security update for its Chromium browser, patching a batch of six vulnerabilities disclosed on the same day. The vulnerabilities, ranging in severity from Medium to High, affect various components of the browser, including V8, Browser, USB, and CredentialProvider. The update addresses critical security flaws that could allow remote attackers to execute arbitrary code, bypass security sandboxes, or compromise user data.
The disclosed vulnerabilities include:
- **Use after free in Browser (CVE-2026-76040):** This vulnerability, affecting Chrome on Mac, could allow a remote attacker, leveraging social engineering, to execute arbitrary code outside the sandbox via a crafted HTML page.
- **Incorrect calculation in V8 (CVE-2026-76043):** A flaw in the V8 JavaScript engine could enable a remote attacker to execute arbitrary code within the sandbox using a specially crafted HTML page.
- **Type confusion in V8 (CVE-2026-76038):** Another V8 vulnerability, this type confusion flaw could also lead to arbitrary code execution inside the sandbox for a remote attacker via a crafted HTML page.
- **Race condition in USB (CVE-2026-76044):** This vulnerability in the USB component could allow a remote attacker, who has already compromised the renderer process, to potentially execute arbitrary code outside the sandbox.
- **Link following in CredentialProvider (CVE-2026-76037):** On Windows, a local attacker could exploit this vulnerability in the CredentialProvider to potentially execute arbitrary code outside the sandbox through a local program.
- **Inappropriate implementation in CORS (CVE-2026-76033):** This Medium severity vulnerability could allow a remote attacker, who has compromised the renderer process, to bypass site isolation.
The update, which brings the stable channel to version 151.0.7922.169/.170 for Windows and Mac, and 151.0.7922.169 for Linux, addresses these security concerns. Users are strongly advised to update their Chromium browsers to the latest version to protect themselves from potential exploitation of these vulnerabilities. The prompt remediation of these issues underscores the importance of timely security updates for widely used software like Chromium.
This batch of vulnerabilities highlights the ongoing efforts by the Chromium security team to identify and fix complex security flaws within the browser's architecture. The variety of vulnerability types—from memory-related issues like use-after-free and type confusion to logic flaws in components like USB and CredentialProvider—demonstrates the multifaceted nature of browser security. Users should remain vigilant and ensure their browsers are consistently updated to mitigate risks associated with newly discovered security weaknesses.