Google and Microsoft have now shipped browser updates for the same five High-severity Chromium vulnerabilities. Google fixed the set in Chrome 151.0.7922.137/.138 for Windows and macOS and 151.0.7922.137 for Linux. Microsoft then documented Edge 151.0.4129.86, based on Chromium 151.0.7922.138, as no longer vulnerable.
These were previously fragmented into five separate articles. They belong together because one Chrome Stable release and one Edge release fixed the complete set.
The five vulnerabilities
| CVE | Chromium component | Google severity | Issue |
|---|---|---|---|
| CVE-2026-19556 | V8 | High | Use after free |
| CVE-2026-19557 | TabStrip | High | Use after free |
| CVE-2026-19558 | Extensions | High | Use after free |
| CVE-2026-19559 | HTML | High | Use after free |
| CVE-2026-19560 | Blink | High | Use after free |
Google's August 11 Stable Channel update lists all five CVEs in one release. Microsoft published the corresponding Edge records on August 14 within seconds of one another. Each MSRC affected-product record names Microsoft Edge (Chromium-based) and maps the fix to Edge 151.0.4129.86.
Fixed browser versions
| Browser/platform | Fixed release |
|---|---|
| Google Chrome on Windows | 151.0.7922.137 or 151.0.7922.138 |
| Google Chrome on macOS | 151.0.7922.137 or 151.0.7922.138 |
| Google Chrome on Linux | 151.0.7922.137 |
| Microsoft Edge (Chromium-based) | 151.0.4129.86, based on Chromium 151.0.7922.138 |
The Chrome and Edge version numbers are different because Microsoft packages Chromium in its own Edge release. A Chrome build number should not be used to decide whether Edge is patched, and an Edge build number should not be used for Chrome.
What Windows users should check
Chrome
- Open Chrome's About page from Help > About Google Chrome.
- Allow the update to complete.
- Relaunch the browser so the patched executable is running.
- Confirm the active version is 151.0.7922.137, 151.0.7922.138, or a later supported build.
Microsoft Edge
- Open Edge's About page from Help and feedback > About Microsoft Edge.
- Allow Edge Update to install the current release.
- Restart Edge.
- Confirm the active version is 151.0.4129.86 or later.
For managed fleets, inventory the running browser version rather than relying only on update-policy status. Browsers can download an update while an older process remains active until users restart. Kiosks, persistent VDI sessions, shared devices, and long-running browser sessions deserve particular attention.
Why one canonical article is more accurate
The earlier pages described the CVEs as separate Chrome-only developments and, in one case, said no Microsoft advisory or fixed Edge version was available. That was caused by processing future-dated MSRC feed entries before the vendor's stated publication time. Once the records became current, Microsoft's actual announcement was clear: Edge 151.0.4129.86 addressed all five Chromium vulnerabilities.
Keeping the release together prevents five copies of the same update checklist, preserves the relationship between the component CVEs, and makes the Chrome-versus-Edge remediation distinction visible in one place. The four redundant pages now permanently redirect here.
