Google shipped a Chrome update on Thursday that fixes seven security bugs, and it rated the worst of them critical. The critical one sits in a corner of the browser many people forget is running.
The flaw, CVE-2026-76017, is a use after free in Chromoting, the component behind Chrome Remote Desktop. A use after free is a memory-safety error, where code reaches for memory it has already released. Google's own researchers reported it on 11 June 2026.
Nothing in the advisory says any of the seven bugs has been used in an attack. Google states that plainly when a Chrome flaw is under active exploitation, and it has not said it here.
The details come from Google's own release note, posted by Srinivas Sista, alongside the matching Android release from Harry Souders. Hong Kong's CERT relayed the update on Friday, rating it medium risk overall and listing remote code execution, elevation of privilege and security restriction bypass among the possible impacts.
One critical, and six highs behind it
The fixed build is Chrome 151.0.7922.173 and .174 for Windows and Mac, 151.0.7922.173 for Linux, and 151.0.7922.173 for Android, which Google says carries the same security fixes as the desktop release. The rollout is staged across days rather than landing everywhere at once.
Google does not publish CVSS scores for Chrome, grading its flaws critical, high, medium or low instead. The Chromoting bug is the lone critical. The other six are all rated high:
- CVE-2026-76018, privilege elevation in Import, reported by Google on 16 May 2026.
- CVE-2026-76019, incorrect authorization in Workers, reported anonymously on 26 July 2026.
- CVE-2026-76020, a race condition in V8, the JavaScript engine, reported by Salvatore Gulizia (nickname Serotav) on 3 August 2026.
- CVE-2026-76021, a use after free in DOM, reported by Google BigSleep@Grape on 2 August 2026.
- CVE-2026-76022, a buffer overflow in Network, reported by 0xAlessandro on 7 August 2026.
- CVE-2026-76023, improper resource control in Linux Toolkit Theming, reported by Keita Sode and Daisuke Hatakeyama of SYZD Research on 11 August 2026.
A machine found one of them
One credit line is worth pausing on. CVE-2026-76021 is credited to Google BigSleep@Grape, Big Sleep being Google's AI bug-hunting agent. Machine-found flaws have been showing up in vendor advisories with growing regularity, including the SharePoint chain disclosed earlier this month. Three of the seven credits here go to outside researchers working by hand, and one to an anonymous reporter, so the browser's bug pipeline is still a mixed one.
Beyond the component names and severity grades, there is little public detail on how any of these work, and that is Google's choice. The advisory notes that access to bug details and links can stay restricted until a majority of users have updated, and that restrictions remain when a bug sits in a third-party library other projects also depend on. Technical write-ups, where they come at all, will come later.
Update to 151.0.7922.173, then restart
Chrome updates itself, but the new build only takes effect once the browser restarts, which is where most people stall. Opening chrome://settings/help forces the check and shows the running version. On Android the update arrives through Google Play over the following days. Anyone running Chrome across a fleet should confirm the version their machines are actually on rather than assume the staged rollout has reached them.
Chrome's previous security release, a 41-flaw update earlier this month, was the kind of bulk patch that is easy to wave through on volume alone. This one is a seventh of the size and carries a heavier single item, which is a fair reminder that the number of fixes in a browser advisory tells you less than the worst rating inside it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.