Google has patched a serious vulnerability in its newly released Chrome 151 Stable version, one that could let attackers execute malicious code remotely. The flaw—tagged as CVE-2026-76017—is a use-after-free bug in Chromoting, the component behind Chrome Remote Desktop. Users across Windows, macOS, and Linux are affected unless they update to the latest patched builds. ([cybersecuritynews.com](https://cybersecuritynews.com/google-chrome-151-chromoting-flaw/))
What’s Broken and Why It Matters
Use-after-free vulnerabilities arise when a program accesses memory that’s already been deallocated. If an attacker can precisely control how that freed memory is reused, the consequences can escalate from a simple crash to arbitrary code execution under the victim’s privileges. In this case, the issue lies in Chromoting—Google’s remote desktop tech embedded within Chrome—making it especially worrisome for users who rely on its remote access features. ([cybersecuritynews.com](https://cybersecuritynews.com/google-chrome-151-chromoting-flaw/))
The bug was internally discovered by Google on June 11, 2026, and classified as critical. It’s the most severe of the seven vulnerabilities fixed in Chrome 151. ([cybersecuritynews.com](https://cybersecuritynews.com/google-chrome-151-chromoting-flaw/))
Other High-Risk Fixes in Chrome 151
Beyond the Chromoting issue, Chrome 151 addresses six other high-severity flaws:
- A privilege-elevation vulnerability in the Import component (CVE-2026-76018); ([cybersecuritynews.com](https://cybersecuritynews.com/google-chrome-151-chromoting-flaw/))
- An incorrect-authorization bug in Workers (CVE-2026-76019); ([cybersecuritynews.com](https://cybersecuritynews.com/google-chrome-151-chromoting-flaw/))
- A race condition in the V8 JavaScript engine (CVE-2026-76020); ([cybersecuritynews.com](https://cybersecuritynews.com/google-chrome-151-chromoting-flaw/))
- Another use-after-free in the DOM component (CVE-2026-76021); ([cybersecuritynews.com](https://cybersecuritynews.com/google-chrome-151-chromoting-flaw/))
- A buffer-overflow vulnerability in Network (CVE-2026-76022); ([cybersecuritynews.com](https://cybersecuritynews.com/google-chrome-151-chromoting-flaw/))
- An improper resource-control issue in Linux Toolkit Theming (CVE-2026-76023). ([cybersecuritynews.com](https://cybersecuritynews.com/google-chrome-151-chromoting-flaw/))
The update is currently available under version numbers 151.0.7922.173 and .174 for Windows and macOS, and version 151.0.7922.173 for Linux users. ([cybersecuritynews.com](https://cybersecuritynews.com/google-chrome-151-chromoting-flaw/))
What Users and Admins Should Do
Because publicly released details are still limited—no proof-of-concept, exploit in the wild reports, or deep technical breakdowns—Google is holding off on full disclosure until more users apply the patch. ([cybersecuritynews.com](https://cybersecuritynews.com/google-chrome-151-chromoting-flaw/))
Users should manually check for updates in Chrome by going to Settings → About Chrome, allow the browser to fetch the latest, and fully restart the browser to ensure the new version takes effect. Meanwhile, organizations managing fleets of devices should verify deployment of Chrome 151 via management tools and make sure no workstation is running a vulnerable version because Chrome hasn’t been restarted. ([cybersecuritynews.com](https://cybersecuritynews.com/google-chrome-151-chromoting-flaw/))
This patch cycle also underscores Google’s defense ecosystem—its in-house bug reports and third-party researchers working with memory-safety tools like AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL—contributing to vulnerability discovery before public exposure. ([cybersecuritynews.com](https://cybersecuritynews.com/google-chrome-151-chromoting-flaw/))
Even without proof of active exploitation yet, the risk remains stark. Attackers targeting Chrome Remote Desktop via Chromoting could exploit this use-after-free to bypass protections and execute malicious code. The presence of multiple memory safety flaws in this release serves as a reminder: browsers are a frequent target, and remote code execution vulnerabilities are among the most dangerous. Watch for Google to lift restrictions on disclosure once adoption of the patched version hits critical mass. ([cybersecuritynews.com](https://cybersecuritynews.com/google-chrome-151-chromoting-flaw/))
Bottom Line
Chrome 151 patches a critical remote code execution flaw in Chromoting (CVE-2026-76017) along with six other high-severity bugs. If you use Chrome Remote Desktop—or just Chrome itself—update now. Unpatched systems could be exposed to serious threats.
This stretch of flaws confirms that memory safety vulnerabilities remain an Achilles’ heel for modern browsers. How well organizations deploy this fix will decide whether attackers gain opportunity. Security-first browser deployment policies are essential. ([cybersecuritynews.com](https://cybersecuritynews.com/google-chrome-151-chromoting-flaw/))
