Google has released Chrome 151 to the Stable channel, addressing five high-severity security vulnerabilities affecting key components of the browser, including the V8 JavaScript engine, Blink rendering engine, Chrome Extensions framework, HTML processing layer, and TabStrip interface.
The update is being rolled out as version 151.0.7922.137/.138 for Windows and macOS, and version 151.0.7922.137 for Linux. Google has indicated that the update will reach all users worldwide over the coming days and weeks.
Details of the Vulnerabilities
All five vulnerabilities addressed in Chrome 151 are classified as use-after-free (UAF) issues. UAF vulnerabilities occur when a program continues to access memory after it has been freed, potentially leading to crashes, information disclosure, or arbitrary code execution.
The specific vulnerabilities are as follows:
- CVE-2026-19556: A UAF flaw in the V8 JavaScript engine, reported by Jihyeon Jeong of Compsec Lab at Seoul National University on July 15, 2026. Google awarded a $500 bug bounty for this discovery.
- CVE-2026-19557: A UAF issue in the TabStrip interface, discovered internally by Google on July 14, 2026.
- CVE-2026-19558: A UAF vulnerability in the Chrome Extensions framework, reported by security researcher @bean5oup on July 20, 2026.
- CVE-2026-19559: A UAF flaw in the HTML processing layer, identified internally by Google on July 28, 2026.
- CVE-2026-19560: A UAF issue in the Blink rendering engine, reported by researcher Huynh Dinh Vu (WinD39) on July 30, 2026.
Google has restricted technical details and proof-of-concept information for these vulnerabilities until a majority of users have updated to Chrome 151, to minimize the risk of exploitation.
Recommendations for Users
To ensure protection against these vulnerabilities, users are advised to update their Chrome browsers promptly. Desktop users can navigate to Help > About Google Chrome to trigger the automatic download of the update and restart the browser. Enterprise administrators should verify that managed Windows, macOS, and Linux endpoints receive Chrome 151 through their software deployment and patch management platforms.
Regularly updating browsers is crucial, as cyber attackers often exploit known vulnerabilities to compromise systems. By keeping software up to date, users can mitigate potential security risks and maintain a safer browsing experience.
