Google shipped a second Chrome stable channel update in three days on August 20, 2026, patching seven security issues including one rated critical: CVE-2026-76017, a use-after-free bug in Chromoting, the component behind Chrome Remote Desktop. The fix landed in Chrome 151.0.7922.173/.174 for Windows and Mac and 151.0.7922.173 for Linux, according to Google’s own Chrome Releases blog. This is separate from the WebGL and Dawn fixes Chrome shipped just two days earlier on August 18.
What CVE-2026-76017 Actually Affects
A use-after-free means Chrome frees a piece of memory tied to a Chromoting session but then keeps a reference to it around, and that stale reference can potentially be manipulated to run attacker-controlled code. Chromoting handles the remote-desktop connections behind Chrome Remote Desktop, so the exposure sits specifically in that session-handling path rather than in general page rendering. Google credits the discovery to its own internal security team, and as with most Chrome advisories, the deeper technical writeup in the Chromium issue tracker stays restricted until most users have updated.
The other six fixes are rated high severity: a privilege elevation bug in Import, an incorrect authorization issue in Workers, a race condition in V8, a use-after-free in the DOM, a buffer overflow in Network, and a resource-control flaw specific to Linux toolkit theming.
Who Should Actually Check This
Most desktop Chrome installs update themselves in the background, so a browser restart closes the gap for the majority of users. It matters more anywhere Chrome Remote Desktop is actually in use: teams supporting remote workers, IT staff doing remote troubleshooting, or anyone using it to reach an unattended machine. Chromoting sessions specifically are the affected surface here, not incidental browser tabs.
It’s also worth a second look anywhere Chrome runs unattended on an older build: managed device fleets, kiosk browsers, and CI environments running headless Chrome. Two patches shipping within 72 hours is a reminder that update automation for those setups needs to actually be verified, not assumed. We covered a similar theme recently with a macOS screen sharing vulnerability being actively exploited, and remote-access tooling in general is having a rough month across platforms.
If a client project involves remote support tooling, screen-sharing features, or anything that leans on Chrome’s rendering stack for canvas-heavy work, this is the kind of release our Web Application Development team checks against whenever a browser patches mid-project, same as we did with the earlier WebGL and Dawn fixes this week.
