Google has released Chrome version 151.0.7922.137/138 for Windows and macOS, and version 151.0.7922.137 for Linux.
This update addresses five high-severity security vulnerabilities, all use-after-free (UAF), that affect various Chrome components, including V8, TabStrip, Extensions, HTML, and Blink.
Google Chrome 151 Update
The rollout of this Stable channel update began on Tuesday, August 11, 2026. Google will continue deployment over the coming days and weeks, making it essential for both enterprise administrators and individual users to update their browsers promptly.
Use-after-free vulnerabilities occur when software continues to access a memory location after the object associated with that memory has been released. In a browser environment, successfully exploiting such a flaw can lead to application crashes, memory corruption, information disclosure, or arbitrary code execution within the browser’s security context.
The actual impact of a UAF vulnerability depends on various factors, including exploitability, sandbox protections, mitigations, and the specific component affected.
The most significant issue in this release is CVE-2026-19556, a high-severity use-after-free vulnerability in Chrome’s V8 JavaScript and WebAssembly engine.
V8 is a critical attack surface since it processes untrusted JavaScript from websites. This vulnerability was reported by Jihyeon Jeong of Compsec Lab at Seoul National University, who earned a $500 reward through Google’s vulnerability reward program.
The remaining four vulnerabilities affect user interface and rendering components within Chrome: CVE-2026-19557 impacts TabStrip, which manages the browser’s tabs; CVE-2026-19558 affects the Extensions subsystem; CVE-2026-19559 pertains to HTML handling; and CVE-2026-19560 exists in Blink, Chromium’s rendering engine.
Google has not published technical proof-of-concept details, exploit chains, or patch-diff analyses for these vulnerabilities. The company indicated that access to bug details may remain restricted until most users have applied the fixes.
This common practice of delayed disclosure helps reduce the likelihood that attackers can quickly exploit publicly available technical information against unpatched systems.
| CVE | Severity | Affected Component | Vulnerability Type | Reporter | Report Date | Reward |
|---|---|---|---|---|---|---|
| CVE-2026-19556 | High | V8 | Use-after-free | Jihyeon Jeong, Compsec Lab, Seoul National University / Research Intern | July 15, 2026 | $500 |
| CVE-2026-19557 | High | TabStrip | Use-after-free | July 14, 2026 | N/A | |
| CVE-2026-19558 | High | Extensions | Use-after-free | @bean5oup | July 20, 2026 | N/A |
| CVE-2026-19559 | High | HTML | Use-after-free | July 28, 2026 | N/A | |
| CVE-2026-19560 | High | Blink | Use-after-free | WinD39 – Huynh Dinh Vu | July 30, 2026 | N/A |
The presence of multiple memory-safety flaws across browser components highlights the importance of timely patch management. Chrome is a high-value target because it processes content from potentially malicious web pages and is widely used across both consumer and enterprise environments.
As of now, Google’s advisory does not indicate that any of the five CVEs are being actively exploited in the wild. However, organizations should prioritize remediation of high-severity browser vulnerabilities, particularly on systems used for privileged administration, financial activities, software development, and access to sensitive internal services.
Administrators should ensure that managed Windows and macOS endpoints are updated to Chrome version 151.0.7922.138 or later, and Linux systems to version 151.0.7922.137 or later. Users can check their installed version by navigating to Settings → About Chrome and relaunching the browser when prompted to complete the update.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world
