Google has released an urgent update for its Chrome desktop browser to address 15 security vulnerabilities, including two critical buffer overflow flaws that could allow remote code execution outside the browser's sandbox. The stable channel has been updated to version 151.0.7922.169/.170 for Windows and Mac users, and 151.0.7922.169 for Linux.
The two critical vulnerabilities are both buffer overflow issues, a type of software flaw where a program writes data beyond the allocated memory buffer, potentially overwriting adjacent memory regions. Such vulnerabilities can be exploited to execute arbitrary code.
The first critical vulnerability, identified as CVE-2026-76034, was discovered in WebGL (Web Graphics Library). WebGL is a JavaScript API that enables web browsers to render interactive 2D and 3D graphics. An attacker could exploit this flaw by tricking a user into visiting a specially crafted HTML page, leading to arbitrary code execution outside the browser's security sandbox.
The second critical vulnerability, tracked as CVE-2026-76036, resides in Dawn. Dawn is an open-source library that serves as the implementation for the WebGPU standard, facilitating direct communication between web applications and computer graphics hardware. Similar to the WebGL vulnerability, this flaw could also allow a remote attacker to execute arbitrary code outside the sandbox through a malicious HTML page.
Vulnerabilities that enable remote code execution outside the browser sandbox are highly prized by attackers. They allow a visit to a compromised or malicious website to escalate into direct code execution on the user's operating system, often without requiring further exploitation steps.
The browser's sandbox is designed to restrict a compromised renderer process's access to sensitive system resources, including files and devices. Bypassing this sandbox significantly enhances an attacker's capabilities, potentially allowing them to steal data, establish persistent access, deploy malware, or move laterally within an enterprise network.
Users are advised to update their Chrome browsers immediately to mitigate these risks. While Chrome typically updates automatically, users can manually trigger the update by navigating to the "More menu" (three dots), then "Settings," and finally "About Chrome." The browser will then download and prompt for a restart to complete the installation of the update.
