Google Releases Chrome Security Update Fixing 15 Vulnerabilities Including Two Critical Flaws
Google has released a security update for its browser Chrome on August 18, 2026, local time. The update fixes multiple vulnerabilities, including two rated as critical in severity.
The company released Chrome 151.0.7922.170 and Chrome 151.0.7922.169 for Windows and macOS, along with Chrome 151.0.7922.169 for Linux. These versions address a total of 15 vulnerabilities, 11 of which were reported by Google itself. The rollout is scheduled to occur gradually over the next several days to weeks.
Two vulnerabilities are classified at the highest severity level of critical. These are a buffer overflow in WebGL tracked as CVE-2026-76034 and a buffer overflow in Dawn tracked as CVE-2026-76036. Both issues were reported by Google after mid-July.
Thirteen additional vulnerabilities rated high severity were also resolved. These include type confusion and calculation errors in the V8 script engine, Use After Free flaws in Browser and WebGL, buffer overflows in ANGLE, and information disclosure issues in Skia.
Other fixes address implementation flaws in CORS, link handling problems in CredentialProvider, race conditions in USB, and the use of uninitialized resources in GPU components.
The complete list of patched vulnerabilities is as follows:
- CVE-2026-76033
- CVE-2026-76034
- CVE-2026-76035
- CVE-2026-76036
- CVE-2026-76037
- CVE-2026-76038
- CVE-2026-76039
- CVE-2026-76040
- CVE-2026-76041
- CVE-2026-76042
- CVE-2026-76043
- CVE-2026-76044
- CVE-2026-76045
- CVE-2026-76046
- CVE-2026-76047
Related articles
N-able Releases Hotfix 4 for Critical N-central RCE Flaw CVE-2026-86218 Now Confirmed Exploited
N-able disclosed a critical vulnerability in its N-central IT operations management platform that allows unauthenticated remote code execution on affected servers. The flaw, tracked as CVE-2026-86218, received the maximum CVSSv4.0 base score of 10.0 and is rated Critical. The company published security advisory information on September 5, 2026, and quickly followed with Hotfix 4 (version 2026.3.1.14) that resolves the issue. Although exploitation was not observed at disclosure, N-able updated the advisory the next day to confirm active exploitation in the wild. The vendor urges customers to apply the hotfix immediately and to monitor for suspicious account creation and scanning activity from specific IP addresses. Earlier hotfixes addressing CVE-2026-86206 and CVE-2026-86207 were superseded by the new release.
Critical Zero-Day CVE-2026-75650 in Adobe Commerce and Magento Allows Unauthenticated Remote Code Execution, Already Exploited
Adobe has released an emergency security update for Adobe Commerce and Magento after discovering a critical zero-day vulnerability that permits remote attackers to execute arbitrary code without authentication. The flaw, tracked as CVE-2026-75650, stems from improper sanitization of special elements in the template engine and carries the maximum CVSSv3.1 base score of 10.0. Adobe rates the issue as Critical and confirms active exploitation in real-world attacks. A hotfix is now available, and the company has assigned the highest priority rating of 1, urging all customers to apply the update within 72 hours. The advisory was published on September 7, 2026, highlighting the need for immediate action due to the severity and confirmed abuse.
Exploiting SSTI Vulnerability in Messenger Machine on Standoff 365 Leads to RCE and Corporate Chat Access
A detailed writeup published by Positive Technologies researcher Seven11eleven demonstrates a full attack chain against the vulnerable Messenger machine on the Standoff 365 platform. The researcher began with network reconnaissance using nmap and directory fuzzing with ffuf, uncovering Swagger documentation and JWT-protected endpoints. After identifying user enumeration through the friend search feature, the team discovered a Server-Side Template Injection flaw in the friendship summary functionality powered by the Mako template engine. The SSTI was escalated to remote code execution by injecting Python expressions that leveraged the self.module.cache.util chain to call os.popen commands. With initial access obtained via reverse shell, the attacker pivoted to neighboring services including Gitness, RabbitMQ, and Redis to achieve the defined business risks of accessing developer corporate messaging and extracting the city messenger encryption key.
SCCM Misconfigurations Expose Organizations to Full Infrastructure Takeover
BI.ZONE expert Alexander Kuznetsov details how Microsoft Configuration Manager (SCCM) deployments in 25% of Russian organizations can grant attackers complete control over corporate infrastructure when misconfigured. The article outlines critical risks including administrative privilege escalation, lateral movement, data collection, persistence, and policy manipulation that allow attackers to blend with legitimate maintenance operations. Key recommendations focus on infrastructure isolation, placing Site Server, SMS Provider, and Site Database Server roles in Tier 0 segments, and avoiding single SCCM hierarchies across multiple Active Directory forests or security tiers. The report emphasizes eliminating Network Access Account (NAA) usage in favor of HTTPS or Enhanced HTTP, strictly limiting Client Push Account and domain join account privileges, and auditing computer accounts for site servers. Additional guidance covers PXE deployment risks, database access restrictions, and role-based administrative controls to prevent credential extraction via tools such as SharpSCCM and mimikatz. Overall, the publication provides actionable hardening steps aligned with the principle of least privilege to reduce the attack surface of widely deployed SCCM environments.