Google has released stable Chrome version 151 updates for Windows, macOS, and Linux, addressing 370 security vulnerabilities. This update includes fixes for seven critical-severity flaws that affect core components of the browser.
The new versions are Chrome 151.0.7922.71/.72 for Windows and macOS, and 151.0.7922.71 for Linux.
The critical vulnerabilities impact several areas, including Chrome’s compositing engine, the Dawn WebGPU implementation, the Views UI framework, the Skia graphics library, Chrome Updater, the ANGLE graphics translation layer, and the Ozone platform abstraction layer.
Many of these issues have been categorized by Google as use-after-free bugs, a race condition, or improper validation of untrusted input.
The seven critical vulnerabilities have been assigned CVE identifiers CVE-2026-17650 through CVE-2026-17656. Use-after-free flaws are present in Compositing, Views, Skia, and Ozone, while CVE-2026-17651 affects Dawn and CVE-2026-17655 affects ANGLE. Additionally, CVE-2026-17654 is a race condition found in Chrome Updater.
Memory safety errors are especially concerning in browsers, as malformed web content can trigger memory corruption in renderer, graphics, or privileged browser processes. Organizations should prioritize this update for internet-facing workstations, shared endpoints, and users who have access to sensitive data.
| Severity | Total |
|---|---|
| Critical | 7 |
| High | 71 |
| Medium | 170 |
| Low | 122 |
| Total | 370 |
Chrome 151 also addresses 71 high-severity vulnerabilities affecting components such as V8, ANGLE, WebGL, GPU, Media, Navigation, Downloads, PDF, Web Authentication, Passwords, Updater, and Site Isolation.
This high-severity set includes multiple use-after-free, out-of-bounds write, integer overflow, type confusion, race condition, and validation issues.
Notable entries in this category include CVE-2026-17658 and CVE-2026-17665, which affect the V8 JavaScript engine; CVE-2026-17675, CVE-2026-17691, and CVE-2026-17721, which involve out-of-bounds writes in ANGLE; and CVE-2026-17725, which is a type confusion flaw in V8.
Google has indicated that technical details and links to the bugs may remain restricted until a significant portion of users have installed the fixes, particularly when third-party dependencies are involved.
Administrators should verify compliance with Chrome deployment and enforce updates where centralized endpoint management tools are available.
Users can manually update by navigating to the Chrome menu, selecting Help, and then About Google Chrome. After updating, they should relaunch the browser to activate the patched version.
Google has credited external researchers as well as its internal security initiatives, including fuzzing and memory-safety tools such as AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL.
Critical CVE Details
| CVE | Severity | Vulnerability |
|---|---|---|
| CVE-2026-17650 | Critical | Use-after-free in Compositing |
| CVE-2026-17651 | Critical | Insufficient validation of untrusted input in Dawn |
| CVE-2026-17652 | Critical | Use-after-free in Views |
| CVE-2026-17653 | Critical | Use-after-free in Skia |
| CVE-2026-17654 | Critical | Race condition in Updater |
| CVE-2026-17655 | Critical | Insufficient validation of untrusted input in ANGLE |
| CVE-2026-17656 | Critical | Use-after-free in Ozone |
High-Severity CVEs
| CVE ID | Vulnerability | Affected component |
|---|---|---|
| CVE-2026-17657 | Use-after-free | Navigation |
| CVE-2026-17658 | Use-after-free | V8 |
| CVE-2026-17659 | Inappropriate implementation | Site Isolation |
| CVE-2026-17660 | Insufficient validation of untrusted input | Network |
| CVE-2026-17661 | Use-after-free | Loader |
| CVE-2026-17662 | Insufficient policy enforcement | Prefetch |
| CVE-2026-17663 | Insufficient validation of untrusted input | GPU |
| CVE-2026-17664 | Insufficient validation of untrusted input | Loader |
| CVE-2026-17665 | Use-after-free | V8 |
| CVE-2026-17666 | Cryptographic flaw | Enterprise |
| CVE-2026-17667 | Uninitialized use | ANGLE |
| CVE-2026-17668 | Uninitialized use | ANGLE |
| CVE-2026-17669 | Inappropriate implementation | Chrome for iOS |
| CVE-2026-17670 | Use-after-free | Views |
| CVE-2026-17671 | Insufficient validation of untrusted input | ANGLE |
| CVE-2026-17672 | Insufficient validation of untrusted input | Chromecast |
| CVE-2026-17673 | Integer overflow | QUIC |
| CVE-2026-17674 | Inappropriate implementation | HTML |
| CVE-2026-17675 | Out-of-bounds write | ANGLE |
| CVE-2026-17676 | Inappropriate implementation | ANGLE |
| CVE-2026-17677 | Inappropriate implementation | ANGLE |
| CVE-2026-17678 | Out-of-bounds read | ANGLE |
| CVE-2026-17679 | Insufficient validation of untrusted input | Print Preview |
| CVE-2026-17680 | Heap buffer overflow | Color |
| CVE-2026-17681 | Insufficient validation of untrusted input | Web Authentication |
| CVE-2026-17682 | Integer overflow | ANGLE |
| CVE-2026-17683 | Inappropriate implementation | ANGLE |
| CVE-2026-17684 | Insufficient validation of untrusted input | Chrome for iOS |
| CVE-2026-17685 | Use-after-free | Autofill |
| CVE-2026-17686 | Insufficient validation of untrusted input | Passwords |
| CVE-2026-17687 | Type confusion | ANGLE |
| CVE-2026-17688 | Use-after-free | Input |
| CVE-2026-17689 | Uninitialized use | ANGLE |
| CVE-2026-17690 | Insufficient validation of untrusted input | |
| CVE-2026-17691 | Out-of-bounds write | ANGLE |
| CVE-2026-17692 | Use-after-free | DataTransfer |
| CVE-2026-17693 | Inappropriate implementation | FileSystem |
| CVE-2026-17694 | Use-after-free | DOM |
| CVE-2026-17695 | Inappropriate implementation | ANGLE |
| CVE-2026-17696 | Side-channel information leakage | Media |
| CVE-2026-17697 | Type confusion | ANGLE |
| CVE-2026-17698 | Insufficient validation of untrusted input | UI |
| CVE-2026-17699 | Use-after-free | Views |
| CVE-2026-17700 | Insufficient validation of untrusted input | Actor |
| CVE-2026-17701 | Out-of-bounds read | ANGLE |
| CVE-2026-17702 | Inappropriate implementation | Skia |
| CVE-2026-17703 | Policy bypass | Chrome for iOS |
| CVE-2026-17704 | Use-after-free | ANGLE |
| CVE-2026-17705 | Integer overflow | libxml |
| CVE-2026-17706 | Insufficient validation of untrusted input | Media |
| CVE-2026-17707 | Uninitialized use | Media |
| CVE-2026-17708 | Use-after-free | Audio |
| CVE-2026-17709 | Race condition | Downloads |
| CVE-2026-17710 | Inappropriate implementation | MHTML |
| CVE-2026-17711 | Race condition | Downloads |
| CVE-2026-17712 | Race condition | Skia |
| CVE-2026-17713 | Insufficient validation of untrusted input | Accessibility |
| CVE-2026-17714 | Uninitialized use | ANGLE |
| CVE-2026-17715 | Inappropriate implementation | Passwords |
| CVE-2026-17716 | Use-after-free | Updater |
| CVE-2026-17717 | Integer overflow | ANGLE |
| CVE-2026-17718 | Use-after-free | ANGLE |
| CVE-2026-17719 | Use-after-free | Input |
| CVE-2026-17720 | Insufficient policy enforcement | Passwords |
| CVE-2026-17721 | Out-of-bounds write | ANGLE |
| CVE-2026-17722 | Object lifecycle issue | WebView |
| CVE-2026-17723 | Use-after-free | Media |
| CVE-2026-17724 | Race condition | Chrome for iOS |
| CVE-2026-17725 | Type confusion | V8 |
| CVE-2026-17726 | Integer overflow | WebGL |
| CVE-2026-17727 | Out-of-bounds write | WebGL |
ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
A December intrusion to Storm-2603, the China-based group Microsoft ties to Warlock ransomware. The attackers…
A decade-old authentication bypass in OpenSSH on musl-based Linux lets attackers log into accounts that…
Bitdefender researchers have revealed a vulnerability called GhostMap that affects Android devices. This vulnerability can…
Microsoft has announced a vulnerability in Windows Paint that could let unauthenticated attackers execute malicious…
An autonomous penetration-testing framework linked to South Korean banking breaches and cloud supply-chain attacks is…
Shopify is making IP allowlisting mandatory for all public apps to limit abuse of stolen…