Chrome Update Addresses Two Critical Buffer Overflow Flaws (CVE‑2026‑76034, CVE‑2026‑76036)
What Happened — Google released Chrome 151 (151.0.7922.169/170) with 15 security fixes, two of which are critical buffer‑overflow vulnerabilities (CVE‑2026‑76034 in WebGL and CVE‑2026‑76036 in Dawn/WebGPU). A remote attacker could craft a malicious HTML page to execute arbitrary code outside Chrome’s sandbox.
Why It Matters for Compliance & Audit Readiness
- Unpatched critical bugs directly violate SOC 2 CC6.1 (System Operations) and CC7.1 (Change Management) which require documented, timely remediation of known vulnerabilities.
- Demonstrating continuous patch‑management evidence (e.g., automated update logs) provides defensible audit proof and reduces the risk of a control gap being flagged during a SOC 2 examination.
- Verisq’s Control Mapping capability lets you map Chrome patching to the relevant SOC 2 controls and automatically collect the update logs as audit‑ready evidence.
Who Is Affected — Enterprises across all sectors that rely on Chrome for web access, especially SaaS providers, fintech firms, and any organization subject to SOC 2 compliance.
Recommended Actions
- Verify that Chrome auto‑updates are enabled on all corporate endpoints; enforce a policy that forces a restart after update.
- Map the Chrome patch‑process to SOC 2 CC6.1/CC7.1 controls and capture update logs via a continuous‑compliance tool.
- Conduct a rapid vulnerability scan to confirm the CVEs are remediated and document the findings for audit evidence.
Source: Malwarebytes Labs
Technical Notes
- Both CVEs are buffer‑overflow flaws that bypass Chrome’s sandbox, enabling remote code execution via crafted WebGL or WebGPU content.
- Exploitation does not require additional privilege escalation; the attacker gains OS‑level code execution directly from a malicious web page.
Source: Malwarebytes Labs