GOOGLE has released an urgent Chrome update that patches two critical buffer overflow flaws affecting Windows, macOS and Linux users. The flaw resides in the WebGL and Dawn components and could let attackers escape the browser sandbox to execute arbitrary code.
The vulnerabilities are tracked as CVE-2026-76034 and CVE-2026-76036, as detailed in a Malwarebytes analysis. Both are described as buffer overflow issues that can be triggered by specially crafted web content, allowing memory corruption outside the sandbox. Chrome versions prior to 151.0.7922.169 are affected, and the update brings the browser to 151.0.7922.169/.170 on Windows and macOS and 151.0.7922.169 on Linux.
Although the CVSS scores are not listed, the flaws are rated critical because they bypass the sandbox protection that isolates rendering processes from the underlying operating system. Exploitation would require a user to visit a malicious site or view a malicious advertisement that invokes the vulnerable WebGL or Dawn code. Successful abuse could lead to the installation of malware, theft of credentials or further lateral movement within a network.
Google said there is no evidence that either CVE-2026-76034 or CVE-2026-76036 has been exploited in the wild, and no threat actors have been linked to the issues. Nevertheless, the potential for drive-by downloads or malvertising campaigns makes the flaw a serious risk for any organization that relies on Chrome for daily work. Administrators should treat the update as a priority to reduce exposure to these sandbox-escape vectors.
The update is part of a broader release that addresses fifteen security problems in total, but the two graphics-related bugs drew the most attention due to their sandbox-escape nature. Prioritising this rollout helps close the most dangerous gap before tackling lower-severity issues.
Users can update Chrome by opening the Settings menu, selecting About Chrome and allowing the browser to download and install the latest version. For managed environments, administrators can push the update through Google Endpoint Management or their existing software distribution tools to ensure all endpoints run 151.0.7922.169 or newer. A official Chrome release note provides the full list of corrected flaws and version numbers.
Security teams should also review web traffic logs for unexpected spikes in WebGL-heavy requests and consider enabling site isolation or stricter content security policies as an additional layer of defence while the update is being deployed. Staying current with Chrome releases remains the simplest way to minimise the risk of browser-based attacks.