CVE-2026-76017: Critical Use-After-Free in Chrome Headlines 7 Security Fixes
Do Son 
TL;DR
Google shipped a Chrome Stable channel update with seven security fixes. The most severe, CVE-2026-76017, is a critical use-after-free flaw in Chromoting. Google reports no exploitation in the wild for any of the seven bugs.
Why It Matters
Chrome runs on billions of desktops worldwide. A memory-safety bug there gives attackers a wide target. This critical use-after-free flaw earns the update urgent attention.
A use-after-free happens when code touches memory after it is freed. Attackers can abuse that state to corrupt memory or run code. In a browser, a crafted page can be enough to start.
How the Attacks Work
Google grouped seven distinct flaws across different Chrome parts. Each affects a separate component, so the mechanisms differ.
CVE-2026-76017 is the lone critical bug, a use-after-free in Chromoting. Another use-after-free, CVE-2026-76021, sits in the DOM. The rest cover privilege elevation, incorrect authorization, a V8 race condition, a network buffer overflow, and a Linux theming flaw. Google details them in the Chrome stable channel update.
Affected Versions
The flaws affect Chrome before 151.0.7922.173. Fixed builds are 151.0.7922.173/.174 for Windows and Mac. Linux moves to 151.0.7922.173. Google restricts bug details until most users update.
Patch and Mitigation Steps
Update Chrome without delay. Open the menu, then Help, then About Google Chrome. The browser fetches the fix, so relaunch to finish. Edge and other Chromium browsers should apply their matching updates too.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
