Google has released Chrome 151, introducing critical security updates that address 41 vulnerabilities, including six classified as critical. These flaws primarily involve memory safety issues that could lead to browser crashes, memory corruption, or unauthorized code execution.
The update is being rolled out gradually, with Windows and macOS users receiving versions 151.0.7922.108/.109, and Linux users getting version 151.0.7922.108. Users are encouraged to update their browsers promptly as the new version becomes available.
Critical Vulnerabilities Patched
The most severe issues addressed in this release are use-after-free vulnerabilities, which occur when software continues to access memory after it has been freed. Exploiting these flaws could allow attackers to execute arbitrary code by convincing users to visit malicious websites.
Two critical use-after-free vulnerabilities affect WebGL, Chrome’s technology for rendering interactive 2D and 3D graphics. These are identified as CVE-2026-19137 and CVE-2026-19170. The first was reported anonymously, while the second was discovered by researchers from STAR Labs SG Pte. Ltd.
Other critical vulnerabilities include:
- CVE-2026-19149: Use-after-free in Aura, Chrome’s user interface framework.
- CVE-2026-19154: Use-after-free in the Skia graphics library.
- CVE-2026-19172: Use-after-free in Views, another Chrome interface component.
- CVE-2026-19157: Out-of-bounds write in ANGLE, the graphics translation layer used by Chrome.
Additional High-Severity Vulnerabilities
In addition to the critical issues, the update addresses 35 high-severity vulnerabilities affecting various browser components, including:
- V8 JavaScript engine
- GPU process
- HTML renderer
- Media subsystem
- Web Authentication implementation
- Extensions platform
- Payment features
- Translation service
- Workers
- Codecs
- Navigation handling
- Crash-reporting functions
Many of these high-severity bugs are memory-related, such as heap buffer overflows, out-of-bounds writes, integer overflows, use of uninitialized memory, and additional use-after-free issues.
Notably, Google awarded $5,000 for CVE-2026-19169, an insufficient validation flaw in Contextual Tasks reported by security researcher Sven Dysthe. Contributions from OpenAI Codex Security, Hap Security, QED Audit, and other independent researchers were also acknowledged.
To minimize the risk of exploitation, Google has withheld technical details and proof-of-concept information for these vulnerabilities until a majority of users have updated their browsers.
Users can update Chrome by navigating to the Chrome menu, selecting Help, and then choosing About Google Chrome. The browser will check for the latest version and prompt for a relaunch after installation. Organizations should prioritize deploying Chrome 151 across managed endpoints to mitigate exposure to these significant vulnerabilities.
Regularly updating browsers is crucial in maintaining security, as web browsers are common targets for attackers due to their widespread use and access to sensitive information. Staying current with updates helps protect against known vulnerabilities and potential exploits.
