Google has promoted Chrome 151 to the stable channel for Windows, macOS and Linux, delivering a major security update that addresses 382 vulnerabilities across the browser’s core engine, graphics stack, extensions framework and cross‑platform components.
The release, dated June 30, 2026, significantly hardens Chrome against memory corruption, type confusion, and policy‑enforcement flaws that could be chained together for remote code execution, sandbox escape, and cross‑platform compromise.
Google Chrome 151 Released
From a risk perspective, the most notable changes are the 15 critical CVEs targeting high‑value attack surfaces such as extensions, GPU, WebUSB, remote access (Chromoting), and core browser infrastructure.
| CVE ID | Severity | Component | Issue type |
|---|---|---|---|
| CVE‑2026‑13774 | Critical | Extensions | Use after free |
| CVE‑2026‑13775 | Critical | GPU | Use after free |
| CVE‑2026‑13776 | Critical | Dawn | Type confusion |
| CVE‑2026‑13777 | Critical | iOSWeb | Insufficient validation of untrusted input |
| CVE‑2026‑13778 | Critical | WebUSB | Use after free |
| CVE‑2026‑13779 | Critical | Chromoting | Use after free |
| CVE‑2026‑13780 | Critical | ANGLE | Insufficient validation of untrusted input |
| CVE‑2026‑13781 | Critical | Skia | Insufficient validation of untrusted input |
| CVE‑2026‑13782 | Critical | Browser | Use after free |
| CVE‑2026‑13783 | Critical | Views | Use after free |
| CVE‑2026‑13784 | Critical | Views | Use after free |
| CVE‑2026‑13785 | Critical | Bluetooth | Use after free |
| CVE‑2026‑13786 | Critical | Ozone | Use after free |
| CVE‑2026‑13787 | Critical | Chromoting | Use after free |
| CVE‑2026‑13788 | Critical | Fullscreen | Use after free |
The update also focuses on input‑validation failures in iOSWeb, WebUSB, ANGLE, Skia and the generic Browser component, emphasizing the importance of enforcing strict trust boundaries around untrusted data flowing from the web and devices.
CVE‑2026‑13778, a use‑after‑free in WebUSB, and CVE‑2026‑13783/13784 in Views illustrate how UI and device‑interaction layers remain attractive targets for attackers aiming to bypass user-consent flows or pivot from the browser to peripheral hardware.
Chromoting, Chrome’s remote‑desktop functionality, receives multiple critical fixes (CVE‑2026‑13779 and CVE‑2026‑13787), underscoring the risk that memory corruption in remote‑access code can directly lead to full session takeover, lateral movement, or data exfiltration in enterprise environments that rely on remote administration.
A critical Bluetooth bug (CVE‑2026‑13785) further expands the attack surface to nearby devices, while a critical Browser‑level use‑after‑free (CVE‑2026‑13782) and critical Fullscreen issue (CVE‑2026‑13788) reinforce that core lifecycle management and security UI remain central to defending against sophisticated phishing and drive‑by attacks.
High‑severity vulnerabilities round out the risk landscape, with bug bounty rewards signaling exploitability and security impact.
CVE‑2026‑13789, the $36,000 use‑after‑free in GPU, stands out as a likely candidate for exploitation research, since prior Chrome campaigns have frequently abused GPU and rendering bugs as reliable primitives for remote code execution chains.
Side‑channel information‑leak issues such as CVE‑2026‑13790 in Scroll and CVE‑2026‑13809 in Safe Browsing show Google’s continued effort to mitigate cross‑site information disclosure, timing attacks and privacy‑impacting leaks in seemingly benign UI and security‑helper subsystems.
The cluster of high‑severity issues in Chromecast (integer overflows, heap buffer overflows and use‑after‑free conditions, including CVE‑2026‑13796 through CVE‑2026‑13804) demonstrates that media‑casting and IoT‑adjacent features remain fertile ground for attackers targeting home and enterprise networks.
Additional high‑severity defects in SVG policy enforcement, WebAppInstalls, Chrome for iOS, QUIC, GFX, Accessibility, Import, and multiple extensions‑related flows collectively reinforce the need for rapid patch deployment across all desktop and mobile platforms.
For defenders, the security guidance is straightforward: prioritize upgrading to Chrome 151 across Windows, macOS and Linux, and ensure managed environments enforce automatic updates via enterprise policies and configuration management.
Given the concentration of critical memory‑safety flaws and high‑impact GPU, Chromecast, and extension vulnerabilities, organizations should treat this release as a high‑priority maintenance window, especially for fleets exposed to high‑risk browsing, remote‑desktop usage, or media casting.
Security teams may also want to review extension trust models, remote‑access exposure and device‑interaction policies (USB, Bluetooth, WebUSB) in parallel with the update, as several of the patched issues directly intersect with those attack surfaces.
Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN
