Google Releases Chrome Security Update Fixing 41 Vulnerabilities Including Six Critical Flaws
Google has released a security update for its Chrome web browser that addresses 41 vulnerabilities, including six rated as Critical. The update was published on August 6, 2026, and applies to Windows, macOS, and Linux users.
The new versions are Chrome 151.0.7922.109 and 151.0.7922.108 for Windows and macOS, and 151.0.7922.108 for Linux. The fixes cover a range of issues discovered in core browser components.
Critical Vulnerabilities Addressed
Six vulnerabilities received the highest severity rating. One notable fix resolves an out-of-bounds write issue in the ANGLE graphics layer, identified as CVE-2026-19157.
Five Use After Free vulnerabilities were also corrected. These affect WebGL (CVE-2026-19137 and CVE-2026-19170), Aura (CVE-2026-19149), Skia (CVE-2026-19154), and Views (CVE-2026-19172).
Additional High-Severity Fixes
The remaining 35 vulnerabilities were classified as High severity. Google has not disclosed any evidence of active exploitation at the time of release.
The complete list of addressed CVEs includes: CVE-2026-19137 through CVE-2026-19177.
The company expects the update to reach users gradually over the next several days to weeks.
Related articles
ServiceNow Patches Multiple Critical Vulnerabilities in Now Platform and AI Platform
ServiceNow disclosed several critical vulnerabilities affecting the Now Platform and ServiceNow AI Platform on August 27. The issues include unauthenticated code injection via the GraphQL Composite Data API, improper access controls during system image uploads, and SQL injection flaws that allow arbitrary database queries. Four CVEs were published: CVE-2026-6876, CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820. Exploitation of CVE-2026-18885 could permit remote code execution and data manipulation without authentication under certain conditions. CVE-2026-18886 enables unauthorized data creation, modification, and privilege escalation, while CVE-2026-74820 allows direct SQL execution against the underlying database. ServiceNow has released updated versions to address the flaws.
CISA Adds Linux Kernel Frag Gap Flaw and Two Other Exploited Vulnerabilities to KEV Catalog
The US Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on August 27, 2026. One of the entries is CVE-2026-53362, a high-severity privilege escalation issue in the Linux kernel also known as Frag Gap. The flaw stems from an out-of-bounds write when generating IPv6 packets, allowing a low-privileged user to obtain root access. The Linux Kernel Organization assigned it a CVSS v3.1 base score of 7.8 and rated it High severity, with public exploit code already available. Federal agencies must remediate CVE-2026-53362 and CVE-2023-49105 by the August 30 deadline. The advisory underscores ongoing exploitation of these issues in the wild.
CISA Adds Six Actively Exploited Vulnerabilities to KEV Catalog Including Citrix NetScaler, Linux Kernel and Microsoft SQL Server Flaws
On August 26, 2026, CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog, signaling confirmed active exploitation and requiring immediate remediation priority. The batch includes a recent memory corruption issue in Citrix NetScaler ADC and NetScaler Gateway tracked as CVE-2026-8452, along with five older flaws affecting Microsoft SQL Server, the Linux kernel, Ajax.NET Professional, Red Hat libuser, and Red Hat ABRT. Citrix released patches for the NetScaler vulnerability on June 30, 2026, while CISA set an August 29, 2026 deadline for federal agencies. Real-world attacks have already deployed web shells and performed reconnaissance after successful exploitation of the Citrix appliance. The remaining CVEs enable remote code execution, local privilege escalation, and denial-of-service conditions across widely deployed enterprise technologies.
Next.js Patches Two Critical RCE Vulnerabilities in Versions 15.5.24 and 16.3.3
Next.js has released security updates to address two critical vulnerabilities that could allow unauthenticated remote code execution. The fixes are available in versions 15.5.24 and 16.3.3. The first issue, tracked as CVE-2026-75604 with a CVSS score of 9.0, affects applications hosted on Windows servers using Pages Router or App Router without Cache Components and stems from a path traversal flaw. The second vulnerability impacts the Image Optimization API when processing malicious AVIF files, enabling code execution through crafted image inputs. Both flaws affect a wide range of versions from 10.0.0 and 13.4 onward. Administrators are advised to update immediately, rebuild containers, and verify production environments run the patched releases, especially on Windows systems and those handling user-uploaded images.