Chrome 151 update patches critical WebGL sandbox flaws

Google is rolling out a new Chrome 151 stable-channel update for desktop, bringing versions 151.0.7922.169 and 151.0.7922.170 to Windows and macOS and 151.0.7922.169 to Linux, with 15 security fixes including two critical buffer overflow vulnerabilities that can break out of the browser sandbox.

The first of the newly patched flaws is a buffer overflow in Chrome’s WebGL implementation, tracked as CVE-2026-76034.^[1][2][3] Public advisories describe the bug as a memory corruption issue that allows a remote attacker to execute arbitrary code outside the sandbox by luring a user to a maliciously crafted HTML page leveraging WebGL content.^[1][3] Chromium engineers have rated the issue critical, reflecting the fact that successful exploitation turns a simple browser visit into code execution on the underlying operating system.^[1][2][3]

The second critical bug affects Dawn, the open-source library Chrome uses as its WebGPU implementation, which acts as a bridge between web applications and graphics hardware.^[6][12] Security write-ups on the Chrome 151 release note that Dawn suffered an insufficient validation of untrusted input flaw that could be triggered via specially crafted web content, creating another avenue for remote attackers to reach code paths that should not be accessible from a renderer process.^[6][12] While this Dawn vulnerability is described as critical in multiple vendor and industry summaries, a public CVE identifier has not yet been clearly associated with it in available documentation.^[6][12]

These two graphics-stack issues land in the context of a much larger hardening push around Chrome 151. Google and independent researchers report that the broader 151 release cycle patched roughly 370 vulnerabilities across the browser, including seven rated critical and 71 rated high severity, spanning components such as Compositing, Views, Skia, Ozone, Dawn and ANGLE.^{[6][9][11][12]} Several of those critical bugs are memory-safety problems like use-after-free and out-of-bounds writes, which are routinely targeted by exploit developers because they can be chained with logic flaws to achieve reliable remote code execution and sandbox escape.^[6][10][12] At the time of writing, there are no confirmed reports that any of the Chrome 151 vulnerabilities were being exploited in the wild before patches became available.^[12]

Chrome vulnerabilities that enable remote code execution outside the browser sandbox are particularly attractive to attackers because they collapse what is normally a multi-stage intrusion into a single click.^[1][3][10] Chrome’s sandbox is designed to constrain a compromised renderer process so it cannot freely access files, devices or other sensitive system resources, but a successful escape substantially expands an attacker’s ability to steal data, drop malware, establish persistence and move laterally inside enterprise networks.^[1][6][10] Given the frequency with which Chrome bugs are weaponized in exploit kits and targeted campaigns, these graphics-related flaws are likely to draw attention from both cybercriminals and state-linked actors once technical details and potential proof-of-concept code circulate more widely.^[6][10][12]

Administrators and end users should not wait for Chrome’s automatic update mechanism to catch up if they rely on the browser for daily work or have it deployed widely across fleets.^[6][9] The safest approach is to manually trigger an update and verify the installed version: open the browser menu (three dots), choose Help, then About Google Chrome, which forces a version check and downloads any pending update before prompting for a restart.^[15] Organizations should ensure that managed Chrome installations on Windows, macOS, Linux, ChromeOS and other Chromium-based browsers track the latest stable build in the 151 line, and consider rolling out emergency patching for high-risk users who regularly browse untrusted web content.^[6][11][13]

References

1. CVE-2026-76034 – Google Chrome WebGL Buffer Overflow
2. August 2026
3. CVE-2026-76034: Google Chrome: Buffer overflow in WebGL in …
6. Chrome 151 Patches 370 Vulnerabilities
9. Google Releases Patches for 370 Vulnerabilities in …
10. Google Chrome 151 Released With 382 Security Fixes for Critical …
11. Chrome 151 Patches 370 Vulnerabilities, 7 Critical – TechRepublic
12. Chrome 151 Patches 370 Vulnerabilities, 7 Critical [2026]
13. Active Exploitation Alert: Google Chrome 151 Security …
15. 382 Security Vulnerabilities Patched, Including 15 Critical Bugs