Google Patches Two Critical Memory Corruption Flaws in Chrome WebGL and Dawn Components
Google has released a security update for Chrome that fixes 15 vulnerabilities, including two critical memory corruption flaws in the WebGL and Dawn components.
The most severe issues are identified as CVE-2026-76034 and CVE-2026-76036. Both are buffer overflow vulnerabilities that may allow writes outside the intended memory boundaries. CVE-2026-76034 resides in WebGL, the technology the browser uses to process 2D and 3D graphics on web pages and applications. The issue was reported internally by Google on 15 July.
CVE-2026-76036 affects Dawn, the Chromium implementation related to WebGPU. This interface provides web applications with more efficient access to device graphics resources and also processes content received during browsing. Memory corruption flaws in these components can cause crashes and, under specific conditions, open the door to remote code execution.
The critical rating increases the urgency for rapid updates on systems exposed to the web. Chrome has been updated to versions 151.0.7922.169/.170 on Windows and macOS and 151.0.7922.169 on Linux. Android received version 151.0.7922.169 with the same security fixes.
Related articles
Mind Games: 30 Years of Hacking and Securing Game Consoles
The article traces the evolution of security mechanisms in home game consoles from the unprotected Atari 2600 in 1977 through hardware locks, optical media protections, and cryptographic boot chains up to the seventh generation. Early systems like the NES relied on the 10NES/CIC chip for mutual authentication using identical Sharp SM590 microcontrollers, which was quickly defeated by Tengen's Rabbit clone and physical pin-clipping attacks. PlayStation introduced SCEx regional signals on discs, leading to widespread modchip installations and swap tricks that bypassed all code verification. Microsoft’s original Xbox implemented a full cryptographic chain of trust starting from the MCPX southbridge, yet it fell to HyperTransport bus sniffing by bunnie Huang and buffer overflows in titles such as MechAssault. Nintendo Wii’s Twilight Hack exploited a stack overflow via an excessively long horse name in The Legend of Zelda: Twilight Princess, enabling unsigned code execution. The piece highlights recurring lessons about the limits of security-through-obscurity and the necessity of protecting both boot chains and runtime memory handling.
Oracle Issues Emergency Patches for Critical Remotely Exploitable WebLogic Server Vulnerabilities
Oracle released an emergency security update on August 18 containing 943 new patches across dozens of enterprise product families. The update addresses multiple high-severity flaws in Oracle WebLogic Server that can be exploited remotely without authentication over IIOP, T3, and RMI protocols. Four vulnerabilities—CVE-2026-60698, CVE-2026-60672, CVE-2026-60696, and CVE-2026-60977—received CVSS scores of 9.8 and can impact confidentiality, integrity, and availability of affected servers. A separate critical issue, CVE-2026-61241, was disclosed in the LDAP server component of Oracle Internet Directory with a maximum CVSS score of 10.0 and affects versions 12.2.1.4.0 and 14.1.2.1.0. Oracle urges customers to maintain supported releases and apply patches promptly, noting prior incidents where unpatched systems were targeted after fixes became available. Organizations are advised to validate patches in test environments before production deployment to minimize operational risk.
Oracle Releases August 2026 Monthly Security Patches Fixing 943 Vulnerabilities
Oracle has published its monthly Critical Security Patch Update on August 18, 2026, addressing a total of 943 vulnerabilities across a wide range of products. This release supplements the company's quarterly Critical Patch Update and includes fixes for third-party software issues, resulting in 925 unique CVEs after removing duplicates. Of these, 710 vulnerabilities received CVSSv3 base scores of 7.0 or higher, with 154 scoring 9.0 or above, including three at the maximum 10.0. A total of 467 flaws can be exploited remotely without authentication. Major products affected include Oracle Fusion Middleware with 262 patches, Oracle E-Business Suite with 120 fixes, and Oracle Database Server with six updates. The next monthly update is scheduled for September 15, 2026, followed by the quarterly release on October 20.
PoC Exploit Released for Android CVE-2026-0075 Allowing Contact Theft Without READ_CONTACTS Permission
A researcher has published a proof-of-concept exploit for CVE-2026-0075 affecting Android 14, 15, 16 and 16 QPR2. The flaw resided in the ContactsProvider2 component and enabled local applications to extract contact database entries through SQL injection and verbose SQLite error responses, bypassing the need for any user-granted permissions. Google rated the issue high severity and addressed it in the June 2026 security bulletin by stripping detailed JSON error information from responses to unprivileged apps. The publicly available PoC on GitHub deliberately avoids requesting READ_CONTACTS or WRITE_CONTACTS and is intended strictly for lab comparison of patched versus vulnerable builds. No confirmed in-the-wild exploitation has been observed yet, but the release of working code increases risk for devices running older firmware. Users are advised to verify that their devices have received the security patch dated 5 June 2026 or later.