CERT-In Warns Chrome Users of High-Risk Security Flaws, Urges Immediate Browser Update

The Indian Computer Emergency Response Team (CERT-In) has warned users of Google Chrome on Windows, macOS and Linux about multiple high-risk security vulnerabilities that could allow remote attackers to compromise affected systems.

CERT-In listed the issue under vulnerability note CIVN-2026-0409, published on August 13, covering multiple vulnerabilities in Google Chrome for Desktop. The warning follows a security update released by Google for Chrome 151 on August 11.

Google has confirmed that the latest desktop update fixes five high-severity vulnerabilities, all involving a class of memory-safety problem known as “use after free.” The affected components include Chrome’s V8 JavaScript engine, TabStrip interface, Extensions framework, HTML processing and Blink rendering engine.

Users running older Chrome versions should therefore update the browser and restart it so that the security patches take effect.

Which Chrome Versions Are Affected?

The vulnerabilities affect Chrome versions released before the latest patched builds.

For Windows and macOS, Google has updated the Stable channel to versions 151.0.7922.137 and 151.0.7922.138. Linux users should be running 151.0.7922.137 or later. Google began rolling out these versions on August 11.

The update is being distributed gradually, which means some users may receive it later than others. Users who have not restarted Chrome after an automatic update should also check their installed version.

Five High-Severity Vulnerabilities Patched

Google’s security bulletin identifies five vulnerabilities addressed by the latest update.

The first, CVE-2026-19556, is a use-after-free vulnerability affecting V8, Chrome’s JavaScript and WebAssembly engine. V8 plays a central role in processing code delivered through websites, making vulnerabilities within the component particularly important from a browser-security perspective.

CVE-2026-19557 affects TabStrip, the part of Chrome responsible for managing browser tabs, while CVE-2026-19558 involves the browser’s Extensions subsystem. Google has also fixed CVE-2026-19559 in HTML processing and CVE-2026-19560 in Blink, Chrome’s underlying web-rendering engine. Google has classified all five vulnerabilities as High severity.

The vulnerabilities are therefore serious, although describing them collectively as “critical” would overstate Google’s own published severity classification.

What Is a Use-After-Free Vulnerability?

A use-after-free vulnerability occurs when software continues trying to access a section of computer memory after that memory has already been released.

Modern browsers constantly create and remove objects while loading websites, executing scripts, displaying graphics and managing tabs. If Chrome incorrectly accesses memory belonging to an object that no longer exists, specially constructed data may potentially manipulate what happens next.

Attackers can sometimes exploit such memory corruption to crash a program or execute code that was never intended to run.

The seriousness of a particular vulnerability depends on the affected component, the conditions required for exploitation and the security boundaries surrounding the vulnerable process.

Malicious Web Content Could Be Used in an Attack

Security authorities assessing the same vulnerabilities have warned that remote attackers could attempt to exploit them by convincing a user to open specially crafted web content.

Hong Kong’s Government Computer Emergency Response Team said successful exploitation could result in remote code execution or denial of service on vulnerable systems. It also advised affected users to upgrade to Chrome 151.0.7922.137 or later.

The precise attack route differs between vulnerabilities. For example, the vulnerability affecting Chrome Extensions may require interaction with a malicious extension rather than simply visiting an ordinary webpage. The National Vulnerability Database says CVE-2026-19558 could be triggered after a user is convinced to install a malicious extension.

Users should therefore be cautious about both unfamiliar links and untrusted browser extensions.

Remote Code Execution Is the Main Concern

Remote code execution is one of the more serious consequences of a software vulnerability because it may allow attacker-controlled instructions to run within the affected environment.

However, this does not automatically mean that exploiting one of these Chrome vulnerabilities would immediately expose every password, banking credential or file stored on a computer.

Chrome uses several layers of protection, including process isolation and sandboxing, which are designed to restrict what compromised browser processes can access. An attacker may need additional vulnerabilities or other techniques to move beyond those security boundaries.

The practical risk remains serious enough to justify prompt updating because browser vulnerabilities are particularly attractive to attackers. Browsers routinely process complex and untrusted information received from websites throughout the day.

Google Has Already Released the Fix

Google released the patched Stable-channel builds on August 11, 2026.

The update contains security fixes for CVE-2026-19556 through CVE-2026-19560. Google normally restricts some technical details about newly patched vulnerabilities until a substantial proportion of users have installed the update. This helps reduce the amount of immediately useful information available to attackers before users are protected.

Google has not stated in its August 11 release note that these five vulnerabilities were being actively exploited in the wild. The warning should therefore not be interpreted as confirmation of an ongoing mass exploitation campaign.

Nevertheless, once security patches become public, attackers can study the changes and attempt to understand the underlying flaws. Delaying an available security update can consequently increase exposure.

How to Update Google Chrome

Chrome usually updates automatically, but users can manually verify that the latest version has been installed.

On a Windows, macOS or Linux computer, users can open Chrome, select the three-dot menu in the upper-right corner and navigate to Help > About Google Chrome. The browser will check for an available update and install it when possible.

Chrome should then be relaunched so that the new browser version replaces the vulnerable process already running on the computer. Government cyber-security guidance covering the flaws similarly recommends updating the browser and restarting it after installation.

Windows and macOS users should confirm that they are running 151.0.7922.137/.138 or a newer release, while Linux users should have 151.0.7922.137 or later.

Organisations Should Check Managed Devices

The CERT-In warning is relevant not only to individual Chrome users but also to organisations managing large numbers of desktop computers.

Enterprises, government departments, educational institutions and other organisations may operate hundreds or thousands of Chrome installations. Even when automatic updates are enabled, devices that have remained offline or browsers that have not been restarted may continue running vulnerable versions.

System administrators should therefore verify the deployed Chrome version across managed endpoints rather than assuming every computer has updated automatically.

Organisations should also review browser-extension policies because one of the vulnerabilities specifically affects Chrome’s Extensions component. Restricting unnecessary or unapproved extensions can reduce the attack surface available through the browser.

Browser Updates Are Increasingly Important for Cyber Security

Web browsers have become one of the most frequently used pieces of software on modern computers. They process websites, documents, video, scripts, advertisements, authentication sessions and increasingly sophisticated web applications.

That complexity also creates a large attack surface.

The five vulnerabilities patched in the latest Chrome update affect major browser components ranging from V8 and Blink to HTML processing and extensions. Their presence demonstrates why browser updates should be treated as security patches rather than optional feature upgrades.

For users running affected versions, the recommended response is straightforward: update Chrome to the latest available stable release and restart the browser without unnecessary delay.

---

Official Sources

CERT-In: Vulnerability Note CIVN-2026-0409 — Multiple Vulnerabilities in Google Chrome for Desktop, published August 13, 2026. CERT-In’s 2026 vulnerability-note index lists the advisory and classifies the Chrome desktop issue as a current security concern.

Google Chrome Release Team: Stable Channel Update for Desktop, August 11, 2026. Google confirms Chrome 151.0.7922.137/.138 for Windows and macOS and 151.0.7922.137 for Linux, along with fixes for five high-severity vulnerabilities.

Additional verification: Hong Kong GovCERT independently advises affected users to install Chrome 151.0.7922.137 or later and warns that successful exploitation could lead to remote code execution or denial of service.

---