Google Chrome: Five High-Severity 'Use After Free' Bugs Patched in Single Update
Google Chrome version 151.0.7922.137 addresses five high-severity 'use after free' vulnerabilities across multiple components, potentially allowing code execution and sandbox escapes.
Key findings
- Five high-severity 'use after free' vulnerabilities disclosed in Google Chrome on August 11, 2026.
- Vulnerabilities affect core components including Blink, V8, Extensions, and TabStrip (macOS).
- All flaws patched in Chrome version 151.0.7922.137.
- Potential for arbitrary code execution within the sandbox and sandbox escapes.
- Update to Chrome 151.0.7922.137 is critical for user security.
On August 11, 2026, Google released Chrome version 151.0.7922.137, addressing a batch of five high-severity vulnerabilities, all stemming from "use after free" errors. These flaws, disclosed on the same day, collectively pose a significant risk to users by potentially allowing remote attackers to execute arbitrary code within the browser's sandbox.
The vulnerabilities span several components of the Chrome browser:
- Blink Rendering Engine: CVE-2026-19560 and CVE-2026-19559 both involve use after free bugs in Blink. These flaws could permit a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a specially crafted HTML page.
- Extensions: CVE-2026-19558 targets the Extensions component. An attacker could exploit this by convincing a user to install a malicious extension, which could then lead to arbitrary code execution inside the sandbox.
- TabStrip (macOS): Specifically affecting Chrome on macOS, CVE-2026-19557 allows a remote attacker who has already compromised the renderer process to potentially escape the sandbox. This is also due to a use after free vulnerability and requires a crafted HTML page.
- V8 JavaScript Engine: CVE-2026-19556 is a use after free vulnerability within the V8 engine, Chrome's JavaScript interpreter. Similar to other Blink-related flaws, it could enable arbitrary code execution within the sandbox via a malicious HTML page.
All five vulnerabilities were fixed in Chrome 151.0.7922.137. Google has not provided specific details on whether these vulnerabilities are being exploited in the wild, but the high severity and the nature of "use after free" bugs often make them prime targets for exploitation. Users are strongly advised to update their Chrome browsers to the latest version to protect themselves from these security risks.
This coordinated disclosure of five high-severity "use after free" vulnerabilities underscores the ongoing challenges in securing complex browser environments. The consistent patching across multiple components highlights the importance of timely updates for maintaining a secure browsing experience. Users should ensure their Chrome installations are automatically updating or manually check for the latest version.