Chrome patched two flaws that let a web page climb out of the browser

Chrome probably updated itself on Tuesday night. Probably. That's the awkward part about a browser that patches quietly in the background - it usually works, and when it doesn't, nothing tells you.

Google pushed 151.0.7922.169 to Windows and Mac on 18 August, closing 15 security holes. Two carry a critical rating, which Chrome hands out sparingly. CVE-2026-76034 is a buffer overflow in WebGL, the component that draws 3D graphics on a page; CVE-2026-76036 is the same class of bug in Dawn, which does that job for the newer WebGPU standard. Both allow a malicious page to run code outside Chrome's sandbox.

The sandbox is the wall that stops a dodgy tab touching the rest of your computer. Break through it and a web page stops behaving like a web page - it can read your files, install software, and survive after you close the browser. That's why those two got the critical label and the other thirteen didn't. There's no sign anyone is using them yet; both came from Google's own researchers back on 15 July.

Checking takes ten seconds. Three-dot menu, Help, About Google Chrome. Opening that page makes Chrome go looking for an update, and if one is sitting there you'll see a Relaunch button. Press it - a downloaded patch does nothing until the browser restarts, and a Chrome that's been open since the start of the month is still running the old code. Edge, Brave, Opera and Vivaldi share the same engine and need updating separately.

Tendvane's app-update tool uses winget to bring your installed programs up to date in one pass, which mainly helps with the ones that have no auto-updater at all.