Google has released an emergency Chrome security update that fixes a critical zero-day vulnerability already being exploited in real-world attacks.

The flaw, tracked as CVE-2026-85046, affects the V8 JavaScript and WebAssembly engine used by Chrome to process web content. The company confirmed that it is aware of an exploit for the vulnerability existing in the wild.

While Google did not disclose details about the attacks, affected targets, or the threat actors behind the activity, the active exploitation notice makes immediate patching important for all Chrome desktop users.

The security update moves Chrome Stable to version 152.0.7977.82/.83 for Windows and macOS. Linux users receive version 152.0.7977.82. Google said the update will roll out gradually over the coming days and weeks.

Chrome 0-Day Vulnerability Exploited

CVE-2026-85046 is described as a high-severity type confusion vulnerability in V8. Type confusion bugs occur when software incorrectly treats a piece of data as one type when it is actually another type.

In a browser engine, this kind of memory-handling error can be dangerous. An attacker may be able to create specially crafted JavaScript or web content that causes Chrome to handle memory unexpectedly.

Depending on the exploit chain, this could lead to browser crashes, data exposure, or the execution of attacker-controlled code within the browser process.

A victim may only need to visit a malicious or compromised website for an exploit attempt to begin. Attackers can also deliver exploit links via phishing emails, malicious advertisements, social media messages, or compromised legitimate sites.

The vulnerability was reported by security researcher Salvatore Gulizia, also known as Serotav, on August 4, 2026. Google awarded a $1,000 bug bounty for the report.

The Chrome update contains 12 security fixes in total. Several of the patched issues are rated high severity and affect important browser components, including V8, WebGL, Network, DevTools, Skia, CacheStorage, Compositing, and CrashReporting.

Among the notable fixes are a race condition in V8, an out-of-bounds write vulnerability in WebGL, use-after-free flaws in Compositing, DevTools, and Skia, and a type confusion issue in Compositing.

Google is restricting access to some vulnerability details until most users have installed the update. This approach is intended to reduce the chance that attackers can quickly reverse-engineer the fixes and build additional exploit code before organizations and individuals patch their browsers.

Chrome users should update immediately by opening the browser menu, selecting Help, and then choosing About Google Chrome. Chrome will check for the latest version and download the update when available.

Users should relaunch the browser after installation to ensure the security fixes are applied. Enterprise administrators should verify that managed endpoints are updated to Chrome 152.0.7977.82 or later.

Security teams should also monitor endpoint telemetry and web-filtering logs for suspicious browser activity, especially phishing campaigns that use newly registered domains or deceptive update prompts.

Because CVE-2026-85046 is actively exploited, delaying the update leaves systems exposed to a known browser attack path.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Critical Chrome 0-Day Vulnerability Actively Exploited in the Wild appeared first on Cyber Security News.

Google has released Chrome 152 for Windows, macOS, and Linux, delivering 327 security fixes and improvements. The update addresses 10 critical vulnerabilities, making it an important security release for individual users and enterprise environments.

Chrome 152 is rolling out as version 152.0.7977.64 for Linux and version 152.0.7977.64/.65 for Windows and macOS. Google said availability will expand to users over the coming days and weeks.

The most serious flaws are memory-safety issues, including several use-after-free vulnerabilities. Such bugs occur when software continues accessing memory after it has been released.

Attackers may be able to exploit these conditions to crash the browser, access sensitive information, or potentially run code in the context of the affected Chrome process.

Chrome 152 Released With 327 Security Fixes

The critical issues affect several Chrome components. CVE-2026-79282 is a use-after-free vulnerability in ANGLE, the graphics translation layer used by Chrome. The flaw was reported by security researcher Goodluck and earned a $25,000 reward.

Other critical vulnerabilities affect Aura, Chrome’s user-interface framework, Chromecast, Views, Safe Browsing, and Mobile components.

Google assigned CVE-2026-79290 and CVE-2026-79052 to use-after-free flaws in Aura. It also fixed CVE-2026-79054 and CVE-2026-79224, both of which are use-after-free issues in Chromecast.

Chrome 152 further patches CVE-2026-79121, an improper input validation vulnerability in Chromecast; CVE-2026-79150, a use-after-free flaw in Views; CVE-2026-78935, an uninitialized-variable issue in Mobile; and CVE-2026-79012, a use-after-free bug in Safe Browsing.

Fixes 10 Critical Vulnerabilities

The update also contains a large set of high-severity fixes affecting ANGLE, WebGL, V8, WebRTC, Extensions, Autofill, GPU, Bluetooth, Sandbox, Passwords, and other browser subsystems.

High-severity bugs include buffer overflows, out-of-bounds reads and writes, type-confusion errors, authorization flaws, race conditions, and information leaks.

Several high-severity fixes concern ANGLE, including out-of-bounds writes, buffer overflows, type confusion, use-after-free conditions, and uninitialized resources.

Since ANGLE processes graphics-related content, malicious web pages could potentially use specially crafted graphics or WebGL data to reach vulnerable browser code.

Google has not said that any of the fixed vulnerabilities are being actively exploited in attacks. However, the company is temporarily restricting access to bug details and links until most users have updated.

Google may also retain restrictions when a flaw in a third-party library has not yet been fixed in other dependent projects. Users should update Chrome immediately by opening the browser menu, navigating to Help, selecting About Google Chrome, and relaunching after the update downloads.

Organizations should verify that managed endpoints update to Chrome 152 as it becomes available through their established update channels.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Google Chrome 152 Released With 327 Security Fixes, Including 10 Critical Vulnerabilities appeared first on Cyber Security News.

Google has released a new Chrome Stable channel update that fixes two critical security vulnerabilities affecting graphics-related components. Users should update their browsers as soon as the release becomes available for their device.

The update moves Chrome to version 151.0.7922.169/.170 on Windows and macOS, while Linux users receive version 151.0.7922.169. Google said the rollout will occur gradually over the coming days and weeks.

The two critical issues are tracked as CVE-2026-76034 and CVE-2026-76036. Both are buffer overflow vulnerabilities, a memory-safety flaw that can occur when software writes more data into a memory area than it was designed to hold.

Such bugs can lead to browser crashes, data corruption, or potentially arbitrary code execution in certain attack scenarios. CVE-2026-76034 affects WebGL, Chrome’s interface for rendering interactive 2D and 3D graphics inside websites.

Online games, visualizations, browser-based design tools, and other graphics-heavy web applications widely use WebGL. A malicious website could potentially attempt to trigger the flaw through specially crafted WebGL content.

The second issue, CVE-2026-76036, is a buffer overflow in Dawn. Dawn is Chromium’s implementation of the WebGPU standard, a newer graphics API intended to provide web applications with more direct and efficient access to graphics hardware.

Because WebGPU and related graphics components process complex data from web content, memory corruption issues in these areas can represent a significant browser security risk.

Google credited its own security team with reporting CVE-2026-76034 on July 15, 2026, and CVE-2026-76036 on July 28, 2026. The company has not publicly disclosed technical details, proof-of-concept code, or exploitation information.

It said access to bug reports may remain restricted until most Chrome users have installed the fixes, reducing the opportunity for attackers to reverse-engineer patches and weaponize the vulnerabilities.

In total, the Chrome 151 Stable release includes 15 security fixes. Google also noted that it uses memory-error detection and fuzzing technologies, including AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL, to identify security bugs during development.

Users can update Chrome by opening the browser menu, selecting Help, then About Google Chrome. Chrome will automatically check for the latest available build and prompt users to relaunch once the update has downloaded.

Organizations should ensure managed Windows, macOS, and Linux endpoints receive the new Chrome version through their normal patch-management process.

Security teams should also monitor browser version compliance, particularly on systems that regularly access untrusted websites or use web-based graphics applications.

Google’s published release notes identify the affected builds and confirm that the update contains 15 security fixes, including two critical buffer overflow vulnerabilities in WebGL and Dawn.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Google Fixes Two Critical Chrome Flaws in WebGL and Dawn — Update Your Browser appeared first on Cyber Security News.

Google has released Chrome 151 to the Stable channel, fixing 41 security vulnerabilities, including six critical memory-safety flaws that could enable browser crashes, memory corruption, or malicious code execution.

Chrome 151.0.7922.108/.109 is rolling out for Windows and macOS systems, while Linux users are receiving version 151.0.7922.108.

Google said the release will be delivered to users gradually over the coming days and weeks. Users are advised to update as soon as the new version becomes available.

The most serious bugs patched in this release are use-after-free vulnerabilities. These flaws occur when software continues to access memory after it has been released.

An attacker may exploit such weaknesses by convincing a target to visit a specially crafted website or interact with malicious web content.

Two critical use-after-free issues affect WebGL, Chrome’s technology for rendering interactive 2D and 3D graphics in web pages. They are tracked as CVE-2026-19137 and CVE-2026-19170.

Chrome 151 Vulnerabilities

The first was reported anonymously, while the second was discovered by Muhammad Alifa Ramdhan, Pan ZhenPeng, and Billy Jheng Bing Jhong of STAR Labs SG Pte. Ltd. Other critical flaws include CVE-2026-19149, a use-after-free bug in Aura, Chrome’s user interface framework.

CVE-2026-19154, a use-after-free vulnerability in the Skia graphics library, and CVE-2026-19172, a use-after-free flaw in Views, another Chrome interface component.

Google also resolved CVE-2026-19157, an out-of-bounds write vulnerability in ANGLE, the graphics translation layer used by Chrome. In addition, the update patches 35 high-severity vulnerabilities affecting a broad range of browser components.

These include Chrome’s V8 JavaScript engine, GPU process, HTML renderer, media subsystem, Web Authentication implementation, extensions platform, payment features, translation service, workers, codecs, navigation handling, and crash-reporting functions.

Several of the high-severity bugs are memory-related, including heap buffer overflows, out-of-bounds writes, integer overflows, use of uninitialized memory, and additional use-after-free issues.

Critical Vulnerabilities Patched

Such bugs are especially important because web browsers process untrusted data from websites, advertisements, downloaded files, scripts, and extensions.

Among the externally reported issues, Google awarded $5,000 for CVE-2026-19169, an insufficient validation flaw in Contextual Tasks reported by security researcher Sven Dysthe.

Researchers from OpenAI Codex Security, Hap Security, QED Audit, and other independent contributors were also credited with reporting vulnerabilities that were fixed in this release.

Google has withheld technical details and proof-of-concept information for the vulnerabilities until most users update Chrome, aiming to reduce the risk of attackers exploiting unpatched systems.

Chrome users can update the browser by opening the Chrome menu, selecting Help, and then choosing About Google Chrome. The browser will check for the latest version and prompt the user to relaunch after installation.

Organizations should prioritize deploying Chrome 151 across managed Windows, macOS, and Linux endpoints to reduce exposure to these high-impact browser vulnerabilities.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Google Chrome 151 Fixes 41 Security Flaws, Including 6 Critical Memory Bugs appeared first on Cyber Security News.