Google Releases Chrome 151 with 370 Security Fixes

Severity: High
Affected Products: Google Chrome (Windows, macOS, Linux, Android)

Executive Summary

Google has released Chrome 151, a significant security update that addresses 370 vulnerabilities across the Chrome browser, including 7 critical, 71 high, 170 medium, and 122 low-severity security flaws. This represents one of the largest Chrome security updates released this year and reinforces how aggressively attackers continue to target web browsers as an initial access vector.  

Several of the critical vulnerabilities involve memory corruption issues, such as use-after-free, insufficient validation of untrusted input, and a race condition. If successfully exploited, these weaknesses could allow attackers to execute arbitrary code, crash the browser, bypass security protections, or potentially gain control of a user's system simply by convincing them to visit a malicious website.  

Why This Matters

For many organizations, the web browser has become the primary gateway to corporate resources, cloud applications, SaaS platforms, email, and sensitive business data. As a result, browsers have become one of the most attractive targets for cybercriminals.

Unlike attacks that require users to download malware or execute suspicious files, browser vulnerabilities can often be exploited simply by visiting a compromised or malicious webpage. Successful exploitation may allow an attacker to:

• Execute malicious code on the victim's device.  

• Steal browser sessions or authentication tokens.  

• Escape browser security boundaries.  

• Deliver additional malware such as ransomware or information stealers.  

• Establish an initial foothold within the corporate environment.  

Critical Vulnerabilities

Chrome 151 addresses seven critical vulnerabilities, identified as CVE-2026-17650 through CVE-2026-17656, affecting several core browser components.  

1. Use-After-Free Vulnerabilities

Several critical vulnerabilities are use-after-free memory corruption flaws affecting:

• Compositing  

• Views  

• Skia  

• Ozone  

A use-after-free vulnerability occurs when Chrome continues using memory that has already been released. An attacker can manipulate this freed memory with carefully crafted web content, potentially causing the browser to execute attacker-controlled code. These vulnerability types are among the most common paths to remote code execution (RCE) in modern browsers.

2. Insufficient Validation of Untrusted Input

Critical validation flaws were identified within:

• Dawn (WebGPU)  

• ANGLE graphics layer  

These components process data received from websites before it interacts with system resources. When user-controlled input is not properly validated, attackers may be able to supply specially crafted content that causes unexpected behaviour, memory corruption, or bypasses intended security controls.

3. Race Condition in Chrome Updater

A race condition exists within the Chrome Updater component. Race conditions occur when two or more operations execute simultaneously in an unexpected order, potentially allowing attackers to interfere with privileged processes or manipulate system state before security checks complete. While its more complex to exploit, compared to memory corruption issues, race conditions can still become valuable building blocks in sophisticated attack chains.

Versions Released

Organizations should ensure endpoints are updated to the following versions or later:

• Windows: 151.0.7922.71 / 151.0.7922.72  

• macOS: 151.0.7922.71 / 151.0.7922.72  

• Linux: 151.0.7922.71  

• Android: Chrome 151 rollout is also underway.  

Recommendations

• Deploy Chrome 151 across all managed endpoints as soon as operationally possible.  

• Verify all enterprise-managed browsers have updated successfully to the latest stable release.  

• Restart browsers after updating to ensure patches are fully applied.  

• Prioritise updates for privileged users, executives, developers, and internet-facing systems.

‍