Google Releases Chrome 151 Fixing 41 Vulnerabilities Including Six Critical Flaws
Google has released Chrome 151 containing fixes for 41 security vulnerabilities, including six critical flaws that can trigger memory corruption, browser crashes, and potential remote code execution on victim systems.
The new versions 151.0.7922.108 and 151.0.7922.109 are being distributed to Windows and macOS users, while Linux receives version 151.0.7922.108. Deployment occurs gradually across the user base.
Among the most severe issues are two use-after-free vulnerabilities in WebGL, recorded as CVE-2026-19137 and CVE-2026-19170. This class of flaw occurs when the browser continues to reference a memory region after it has already been freed, potentially allowing attackers to manipulate program behavior.
Other critical errors impact the Aura, Skia, and Views components, identified as CVE-2026-19149, CVE-2026-19154, and CVE-2026-19172. An additional critical issue, CVE-2026-19157, involves an out-of-bounds write in ANGLE.
In exploitation scenarios, a specially crafted webpage can attempt to trigger these flaws while the browser processes web content. The actual impact depends on the specific vulnerability and the security protections present in the underlying operating system.
Google has temporarily restricted technical details and proof-of-concept code for some of the flaws, a standard measure to reduce exposure while the update reaches the majority of users.
Users should open Chrome settings, navigate to Help, and select About Google Chrome to verify and install the update. Enterprises are encouraged to prioritize deployment of Chrome 151 across Windows, macOS, and Linux environments.
Related articles
WordPress Patches High-Severity XSS2Shell Flaw Enabling Remote Code Execution (CVE-2026-64638)
WordPress has released a fix for a high-severity vulnerability in its core that can turn a malicious login attempt into remote PHP code execution on the server. The flaw, tracked as CVE-2026-64638 and rated 8.9 on CVSS, is named XSS2Shell and begins as a reflected cross-site scripting issue on the authentication screen. An unauthenticated attacker can submit a specially crafted username that bypasses sanitization mechanisms due to differences in how PHP and WordPress interpret certain characters, allowing controlled HTML elements to be injected into the login page. This leads to JavaScript execution in the site domain, and when an authenticated administrator visits a prepared page, the attacker can abuse the existing session to authorize application credentials and upload arbitrary PHP code. The patch is included in WordPress 7.0.3 released on August 6, with backports available for branches as old as 4.7. No public exploitation has been confirmed yet, but the technical details make immediate updating a priority for site administrators.
Dell Fixes 70 Vulnerabilities in VSI for VMware vSphere Including Two Critical Flaws
Dell has released an update addressing 70 vulnerabilities in Dell Virtual Storage Integrator for VMware vSphere Client, two of which are product-specific and rated critical. The advisory published on August 6, 2026, covers both native issues and flaws inherited from third-party components. CVE-2026-67261 allows unauthenticated remote attackers to execute arbitrary OS commands with root privileges via the IAPI component. CVE-2026-54489 enables session hijacking by exposing active session credentials without authentication. The product integrates Dell storage arrays with VMware vSphere environments and is widely used in enterprise virtualization deployments. Administrators are urged to apply the latest version immediately to mitigate the risks of full system compromise and unauthorized administrative access.
Top 10 Security Stories: WordPress XSS Flaw, PHP Vulnerabilities, and VMware ESX Issues Lead Weekly Roundup
Security NEXT has published its weekly ranking of the most viewed articles for the period from August 2 to August 8, 2026. The list highlights critical vulnerabilities affecting widely used platforms including WordPress, PHP, pgAdmin 4, VMware ESX, and Chrome. Several entries focus on newly released security updates and ongoing exploitation warnings issued by US authorities. The ranking also includes real-world incidents such as credit card skimming by employees and data leaks caused by phishing attacks. This weekly overview reflects the topics that drew the highest attention from the Japanese cybersecurity community during the specified week.
CISA Adds Progress Kemp LoadMaster Command Injection Flaw CVE-2026-8037 to KEV Catalog After Confirmed Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency has added a known command injection vulnerability in Progress Software's Kemp LoadMaster application delivery product to its Known Exploited Vulnerabilities catalog. The flaw, tracked as CVE-2026-8037, allows unauthenticated attackers to execute arbitrary commands on affected devices because input values are not properly sanitized. CISA issued the addition on August 7, 2026, and directed federal agencies to apply mitigations by August 10, 2026. The same product was previously targeted through another flaw, CVE-2024-1212, which was also added to the KEV list after exploitation. Security researchers note that the vulnerability poses a broad risk because it requires no authentication and can be leveraged to compromise load balancers and related infrastructure. Organizations using Progress Kemp LoadMaster are urged to review vendor advisories and implement available patches without delay.