Google Releases Chrome Security Update Fixing 370 Vulnerabilities Including Seven Critical Issues
Google has released a comprehensive security update for Chrome that resolves 370 vulnerabilities, including seven rated Critical.
The update, published on July 29, 2026, provides new builds for Windows and macOS (Chrome 151.0.7922.72 and Chrome 151.0.7922.71) as well as Linux (Chrome 151.0.7922.71). According to the advisory, the fixes address a wide range of issues tracked under CVE identifiers.
Critical Vulnerabilities
Seven vulnerabilities received the highest severity rating of Critical. These include:
- CVE-2026-17650 – Use After Free in the Compositing rendering engine
- CVE-2026-17652 – Use After Free in the Views UI component
- CVE-2026-17653 – Use After Free in the Skia graphics library
- CVE-2026-17656 – Use After Free in the Ozone display platform
- CVE-2026-17651 and CVE-2026-17655 – input validation flaws in the Dawn and ANGLE graphics components
- CVE-2026-17654 – race condition in the Updater component
The remaining issues comprise 71 High-severity vulnerabilities, 170 Medium-severity vulnerabilities, and 122 Low-severity vulnerabilities.
Google stated that the update will be rolled out gradually to users over the next several days to weeks.
Related articles
Fundamental Flaw in File Monitoring APIs Exposes Keystrokes and App Activity Across Windows, Linux, Android, and macOS
Researchers from Graz University of Technology demonstrated how built-in file change notification mechanisms can leak sensitive user activity without requiring elevated privileges. The affected subsystems include inotify on Linux, FileObserver on Android, ReadDirectoryChangesW on Windows, and FSEvents on macOS. On Linux the technique enables reconstruction of typed text with 93-100% accuracy by monitoring /dev/input/event4 timestamps. Android apps can break sandbox isolation to observe messaging events, while Windows monitoring of browser cache files reveals visited websites at 97.8% accuracy. Only partial mitigations have been deployed in Linux and Windows, with no fixes available for Android or macOS. Additional attacks remain possible, including detection of password prompts to facilitate phishing overlays.
16-Year-Old Researcher Discovers Authentication Bypass in Microsoft Titan Analytics Platform
A 16-year-old security researcher using the pseudonym Faav identified a critical flaw in Microsoft Titan, the company's internal analytics platform. The vulnerability allowed an attacker to submit forged JSON Web Tokens that bypassed signature verification and granted administrator privileges. With these rights, the researcher could execute arbitrary SQL queries against connected databases containing metadata from nearly 10,000 tables. Microsoft received the report on September 5, disabled public API access four days later, and issued a $5,000 bounty on September 17. No evidence has emerged that the issue was exploited by malicious actors before remediation. The researcher accessed only limited metadata and a small number of records during testing and did not exfiltrate customer personal data.
Quantum Randomness Failures Allow AI to Extract Predictable Patterns from QRNG Devices
Quantum physics can generate true randomness, yet engineering flaws in QRNG implementations often introduce predictable noise that attackers can exploit. The European Telecommunications Standards Institute has published ETSI TR 104 171, a technical report guiding the design and evaluation of quantum random number generators used in cryptographic key creation. The report highlights that sensors, power supplies, signal processors, and post-processing algorithms can leak patterns even when statistical tests pass. Artificial intelligence systems are now capable of analyzing large datasets to detect these subtle correlations. Side-channel emissions such as power consumption and electromagnetic radiation further increase the risk by linking physical signals to output values. ETSI recommends adopting an entropy zero trust model that includes continuous monitoring, hardware protection, encrypted delivery channels, and detailed logging of generation events. In multi-tenant environments, client streams must remain isolated to prevent cross-contamination of entropy sources.
CISA Sets September 30 Deadline for Federal Agencies to Patch Actively Exploited Citrix NetScaler Zero-Days
CISA has ordered U.S. federal agencies to apply patches by September 30 for two actively exploited zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway. The flaws, tracked as CVE-2026-88771 and CVE-2026-88772, enable unauthenticated remote code execution under default configurations and affect systems commonly exposed to the internet. CVE-2026-88771 allows remote code execution without authentication on NetScaler ADC and Gateway, while CVE-2026-88772 can trigger remote code execution or denial of service via a memory overflow when DTLS is enabled on VPN vServers. Citrix has released fixes for versions 14.1 and 13.1, including FIPS and NDcPP builds, with minimum required builds of 14.1-73.37 and 13.1-64.23. The advisory also covers six additional vulnerabilities from CVE-2026-88773 to CVE-2026-88778 involving HTTP request smuggling and TCP ISN prediction issues. Unsupported branches NetScaler 12.1 and 13.0 receive no patches, requiring immediate migration. Organizations are advised to inventory instances, check for compromise indicators before patching, and preserve forensic evidence.