Google Rolls Out 3 Critical Chrome Memory Fixes In 48 Hour Period
If you are one of the 3.5 billion people using Google’s Chrome web browser, then buffer overflow and use-after-free are among the security issues you likely have never heard of. Thankfully, the Google security team knows all about such memory vulnerabilities and, within just 48 hours, has released application updates to fix three such critical flaws.
The good news is that CVE-2026-76034, CVE-2026-76036 and CVE-2026-76017 have all been rendered harmless as long as you have restarted your browser after the automatic update process. Less so is the fact that more vulnerabilities are being discovered by bounty hunters assisted by AI tools, leaving Google fighting a battle to patch them before less conscientious hackers find them and put them to criminal use.
In an August 18 announcement, Google Chrome’s Srinivas Sista confirmed that a total of 15 vulnerabilities had been addressed by the update, bringing Chrome to version 151.0.7922.169/.170 for Windows, Mac and Linux. Of these, two were critical-rated and both were of the buffer overflow variety. Within 48 hours, Sista was back with a new announcement: Chrome had now been updated to version 151.0.7922.173/.174 due to seven additional vulnerabilities, including one critical use-after-free security issue. This is a repeat of the two-updates-in-two-days event that I reported on July 18, almost exactly a month ago. At the time, I wrote how Google’s technical program manager, Daniel Yip, had confirmed that critical memory vulnerabilities were included.
All three vulnerabilities were found by Google’s own vulnerability security team.
To understand these issues, let’s compare use-after-free and buffer overflow vulnerabilities. Both are critical memory security issues, differing mainly by way of location. A use-after-free vulnerability occurs when a program accesses memory after it's discarded; heap buffer overflows happen when more data is written than allocated. The end results are often similar, including remote code execution, privilege escalation, info leaks and crashes. Which is why you must ensure that the Google Chrome update is downloaded and activated promptly.
You should have already received the automatic security update from Google for your Chrome application. If you are asked to restart your browser, this is a giveaway that it has. If not, you can use the three-dot Chrome menu to manually start the update search, download and installation process.