Google shipped a Chrome stable channel update on August 18, 2026, patching 15 security issues, two of them rated critical. CVE-2026-76034 is a buffer overflow in WebGL. CVE-2026-76036 is a buffer overflow in Dawn, the library that implements WebGPU. Both could let an attacker run code outside Chrome’s sandbox from a page that loads crafted WebGL or WebGPU content. The fix is in Chrome 151.0.7922.169/.170 for Windows and Mac and 151.0.7922.169 for Linux, rolling out over the coming days.
What Else Got Patched
The other 13 fixes are rated high severity. A few stand out. CVE-2026-76038 is a type confusion bug in V8, Chrome’s JavaScript engine, reported August 3. CVE-2026-76045 is a use-after-free in WebGL found by OpenAI Codex Security, an automated bug-hunting system, on August 5. There’s also a second V8 type confusion issue (CVE-2026-76047) and an information leak in Skia, Chrome’s graphics library (CVE-2026-76041). Google’s release notes list all 15 with links to the underlying Chromium issue tracker entries, though some details stay restricted until most users have updated.
Who Needs to Act
Chrome updates itself in the background for most people, so a restart is usually all it takes. Where this matters more is anywhere Chrome runs unattended or gets updated on a slower cycle: managed fleets, kiosk or embedded browser deployments, and CI environments that run headless Chrome for testing or scraping. Those setups don’t restart on their own and are worth checking manually.
The WebGL and Dawn fixes are also worth a second look if a site leans on canvas-heavy interactive work: a 3D product configurator, a WebGL-driven landing page animation, or anything built with Three.js or a similar rendering library. None of that code caused the bug, but it’s the kind of experience that touches the same rendering paths, so a quick smoke test after updating is cheap insurance. This is the same rendering layer our Web Application Development team checks whenever a browser ships a security release mid-project.
