Google Releases Chrome Security Update Fixing 370 Vulnerabilities Including Seven Critical Issues
Google has released a comprehensive security update for Chrome that resolves 370 vulnerabilities, including seven rated Critical.
The update, published on July 29, 2026, provides new builds for Windows and macOS (Chrome 151.0.7922.72 and Chrome 151.0.7922.71) as well as Linux (Chrome 151.0.7922.71). According to the advisory, the fixes address a wide range of issues tracked under CVE identifiers.
Critical Vulnerabilities
Seven vulnerabilities received the highest severity rating of Critical. These include:
- CVE-2026-17650 – Use After Free in the Compositing rendering engine
- CVE-2026-17652 – Use After Free in the Views UI component
- CVE-2026-17653 – Use After Free in the Skia graphics library
- CVE-2026-17656 – Use After Free in the Ozone display platform
- CVE-2026-17651 and CVE-2026-17655 – input validation flaws in the Dawn and ANGLE graphics components
- CVE-2026-17654 – race condition in the Updater component
The remaining issues comprise 71 High-severity vulnerabilities, 170 Medium-severity vulnerabilities, and 122 Low-severity vulnerabilities.
Google stated that the update will be rolled out gradually to users over the next several days to weeks.
Related articles
Critical Vulnerability in Forminator Forms WordPress Plugin Enables Unauthenticated Remote Code Execution
A critical vulnerability tracked as CVE-2026-15748 with a CVSS score of 9.8 has been identified in the Forminator Forms plugin for WordPress. The flaw allows unauthenticated attackers to upload malicious PHP files by manipulating the Select field alongside a File Upload field on published forms. This bypasses extension blocking and file type validation, potentially leading to full server compromise including web shell installation and database access. The plugin, which has more than 600,000 active installations, is affected in all versions up to and including 1.56.1. The issue was resolved in version 1.56.2 released at the end of July, with later updates including 1.57.0 now available.
CISA Adds Four Exploited Vulnerabilities to KEV Catalog Including Critical macOS Authentication Bypass
The US Cybersecurity and Infrastructure Security Agency has added four newly exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. The flaws affect Apple macOS, Microsoft SharePoint, and VMware vCenter among other products. One of the vulnerabilities, tracked as CVE-2026-65400, allows network-based authentication bypass in macOS Screen Sharing without valid credentials. The issue received a CVSS v3.1 base score of 9.8 and is rated Critical. Apple addressed the flaw in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9 released on August 6. Federal agencies have been instructed to apply mitigations within three days.
Apple Releases macOS Tahoe 26.6.2 Fixing 28 Vulnerabilities Including Kernel Flaws
Apple has issued macOS Tahoe 26.6.2, addressing a total of 28 security vulnerabilities tracked under CVE identifiers. The update resolves three kernel-level issues, among them a Use After Free flaw tracked as CVE-2026-65343, an out-of-bounds memory read in CVE-2026-65349, and a memory corruption problem in CVE-2026-65330. Twenty-one of the fixed vulnerabilities affect the WebKit engine, with additional patches applied to Audio, ImageIO, and IOGPUFamily components. The release incorporates fixes that were previously tested in the macOS Golden Gate 27 beta. On the following day, Apple also shipped Safari 26.6.1 for macOS Sonoma and macOS Sequoia, eliminating the same set of 21 WebKit vulnerabilities.
Google Releases Chrome Security Update Fixing 15 Vulnerabilities Including Two Critical Flaws
Google has issued a security update for its Chrome browser that addresses 15 vulnerabilities, two of which are rated critical. The update covers Windows, macOS, and Linux platforms with specific version numbers released on August 18, 2026. Among the fixes are buffer overflow issues in WebGL and Dawn that were reported by Google since mid-July. Thirteen high-severity vulnerabilities were also resolved, including type confusion and calculation errors in the V8 engine, Use After Free flaws in Browser and WebGL, buffer overflows in ANGLE, and information leaks in Skia. Additional problems fixed involve CORS implementation weaknesses, CredentialProvider link handling, USB race conditions, and uninitialized GPU resources. The patches are being rolled out gradually over the coming days and weeks.