VYPR
Vypr IntelligenceAI-generatedAug 6, 2026· 25 CVEs

Google Chrome: 25 Vulnerabilities Patched in Single August 6th Disclosure Event

Google Chrome's August 6, 2026 update addresses 25 vulnerabilities, including critical flaws allowing sandbox escapes and code execution.

Key findings

  • Google Chrome 151 patched 25 vulnerabilities disclosed on August 6, 2026, including critical flaws.
  • Multiple use-after-free vulnerabilities were found across various Chrome components, enabling sandbox escapes and code execution.
  • Critical vulnerabilities include out-of-bounds writes and integer overflows in V8 and other core components.
  • All 25 vulnerabilities are fixed in Chrome 151.0.7922.109 (or 151.0.7922.108 for Linux).
  • The batch included 3 Critical and 20 High severity vulnerabilities, with 3 Low severity issues.

On August 6, 2026, Google released an emergency update for its Chrome browser, patching a staggering 25 vulnerabilities disclosed on the same day. The batch, which spans multiple bug classes including use-after-free, out-of-bounds writes, and integer overflows, highlights ongoing memory safety challenges within the widely used browser. The vulnerabilities, all fixed in Chrome version 151.0.7922.109 (or 151.0.7922.108 for Linux), pose significant risks, with several allowing for sandbox escapes and arbitrary code execution.

A significant portion of the disclosed vulnerabilities are use-after-free flaws, a common memory corruption bug. These include CVE-2026-19176 and CVE-2026-19171 affecting Skia and Media components respectively, both potentially leading to arbitrary code execution or sandbox escapes. CVE-2026-19172, a use-after-free in Views, was rated Critical by Chromium security and could also lead to a sandbox escape. Other use-after-free vulnerabilities were found in Payments (CVE-2026-19175, CVE-2026-19155), WebGL (CVE-2026-19170), Web Authentication (CVE-2026-19166), Extensions (CVE-2026-19165), Media on Windows (CVE-2026-19163), Views (CVE-2026-19159, CVE-2026-19158), and Skia on Android (CVE-2026-19154).

Beyond use-after-free bugs, several critical vulnerabilities involve out-of-bounds writes and integer overflows. CVE-2026-19174 and CVE-2026-19162, both impacting the V8 JavaScript engine, allowed for arbitrary code execution within a sandbox. CVE-2026-19173, an out-of-bounds write in Payments, and CVE-2026-19157, an out-of-bounds write in ANGLE on Android, could lead to sandbox escapes. Insufficient validation of untrusted input was also a recurring theme, with CVE-2026-19177 (UI), CVE-2026-19169 (Contextual Tasks), CVE-2026-19164 (Codecs), and CVE-2026-19153 (Workers) presenting risks ranging from privilege escalation to bypassing site isolation.

The severity of these vulnerabilities is underscored by their high CVSS scores, with three rated Critical (9.6) and the majority High (ranging from 7.5 to 8.8). These flaws could allow remote attackers to execute arbitrary code, escape sandboxes, or escalate privileges, posing a severe threat to user security and data. While no specific threat actor or active exploitation campaign was mentioned in the initial disclosures, the sheer volume and severity of these bugs suggest a significant potential for widespread abuse.

Google addressed these issues by releasing Chrome 151.0.7922.109 for Windows and macOS, and 151.0.7922.108 for Linux. The company is rolling out the update gradually, advising users to update as soon as possible. The update bundles fixes for all 25 disclosed vulnerabilities, emphasizing the importance of maintaining up-to-date browser software.

This coordinated disclosure event serves as a stark reminder of the continuous security efforts required to protect users in the complex browser ecosystem. The concentration of critical memory safety bugs in a single release highlights the persistent challenges in developing secure software and the critical role of diligent security research and rapid patching by vendors like Google. Users are urged to ensure their Chrome browsers are updated to the latest version to mitigate these risks.

The batch also included lower-severity issues, such as CVE-2026-19167, CVE-2026-19161, and CVE-2026-19160, all related to integer overflows or uninitialized use in the GPU or Skia components. While these had lower CVSS scores (3.1), they could still lead to information leakage, demonstrating the breadth of security concerns addressed in this single update. The fix for all these issues is included in the aforementioned Chrome 151 releases.

The vulnerabilities patched include:

The rapid patching of these 25 vulnerabilities underscores Google's commitment to Chrome's security, but also highlights the ongoing cat-and-mouse game between vulnerability discovery and exploitation in the software development lifecycle. Users are strongly encouraged to ensure automatic updates are enabled or to manually check for and install the latest version of Chrome.

The affected versions are all prior to 151.0.7922.109 (or 151.0.7922.108 for Linux). The fixes are contained within these specific versions, meaning any version below them is vulnerable. The broad range of components affected—from V8 and Skia to specific features like Payments, WebGL, and ANGLE—indicates a systemic challenge in securing the complex codebase of a modern web browser.

The disclosure on August 6, 2026, with all CVEs published within a minute of each other, suggests a coordinated release by Google's security team or a Chromium CNA. This rapid release of information allows users and security professionals to be aware of the risks and apply patches promptly. The related news coverage from Cyber Security News confirms the release of Chrome 151 and mentions the patching of six critical memory bugs, aligning with the disclosed CVEs.

The potential impact of these vulnerabilities is severe, ranging from data leakage and cross-origin information disclosure to full system compromise through sandbox escapes and arbitrary code execution. The fact that many of these vulnerabilities require only a "crafted HTML page" or interaction with a "malicious extension" means that simply browsing the web or installing a seemingly innocuous extension could lead to a security breach.

This batch of vulnerabilities emphasizes the critical importance of continuous security auditing and robust memory safety practices in software development. For users, the primary defense remains timely updates. For developers, it's a call to reinforce secure coding practices and invest in advanced security tooling to catch such flaws earlier in the development cycle. The browser, as a primary gateway to the internet, must remain a secure environment, and this incident highlights the ongoing efforts and challenges in achieving that goal.

AI-written article. Grounded in 25 CVE records listed below.