Chrome 151 Patches 370 Vulnerabilities

Summary

Google released Chrome 151 to the stable channel, addressing 370 vulnerabilities including seven critical-severity bugs such as use-after-free issues and race conditions. The update resolves 71 high-severity defects and 292 medium and low-severity weaknesses, with 30 vulnerabilities affecting ANGLE (the WebGL backend). Google credited external researchers with reporting 21 issues and paid $58,500 in bug bounty rewards.

Full text

Google on Wednesday announced the release of Chrome 151 to the stable channel with patches for 370 vulnerabilities. The update resolves seven critical-severity bugs, including four use-after-free issues in Compositing, Views, Skia, and Ozone. Chrome 151 also resolves two critical-severity insufficient validation of untrusted input flaws in Dawn and ANGLE, and a critical race condition in Updater. More than a dozen of the 71 high-severity defects addressed with the update are use-after-free vulnerabilities affecting Navigation, V8, Loader, Views, Autofill, Input, DataTransfer, DOM, ANGLE, Audio, Updater, and Media. Other types of patched high-severity bugs include inappropriate implementation, insufficient policy enforcement, insufficient validation of untrusted input, uninitialized use, integer overflow, out-of-bounds read/write, type confusion, policy bypass, race condition, object lifecycle issue, and cryptographic flaw. The fresh Chrome update also resolves 170 medium-severity weaknesses and 122 low-severity security defects.Advertisement. Scroll to continue reading. It’s worth noting that 30 of the resolved vulnerabilities impact ANGLE (Almost Native Graphics Layer Engine), the open source WebGL backend that Chrome uses for all graphics rendering. Google says it found 349 of the newly fixed security defects and credited external researchers for reporting 21 issues. The internet giant says it paid $58,500 in bug bounty rewards to the reporters, but has yet to disclose the amounts handed out for 13 flaws. With the fresh round of security patches, Google has resolved over 1,800 vulnerabilities in Chrome since the beginning of the year. The latest Chrome iteration is now rolling out as versions 151.0.7922.71/.72 for Windows and macOS, and as version 151.0.7922.71 for Linux. Related: Critical VM Escape Vulnerability Patched in VMware ESXi Related: JFrog Zero-Days Exploited in OpenAI-Hugging Face Hack Related: Apple Patches 87 Vulnerabilities in iOS, 155 in macOS Tahoe Related: Unpatched Fastjson Vulnerability Exploited in Attacks Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire JFrog Zero-Days Exploited in OpenAI-Hugging Face HackShinyHunters Claims Ernst & Young HackOT Security Startup Frenos Raises $1.52 MillionHush Security Raises $30 Million for AI Agent GovernanceGoogle Adopts New Threat Actor Naming SystemUnpatched Fastjson Vulnerability Exploited in AttacksCritical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-DayNew GitHub, PyPI Policies Boost Supply Chain Security Latest News Cisco Secure FMC Zero-Day Exploited in the WildUS Bans Foreign-Made Humanoid Robots, Targeting China Over National SecurityMate Security Raises $35 Million for Agentic SOCThreatLocker Raises $190 Million in Series F FundingCritical VM Escape Vulnerability Patched in VMware ESXiUS, Australia Release OT Isolation Guidance for Critical Infrastructure OpenAI’s Rogue AI Ventured Beyond Hugging FaceSpur Raises $200 Million for IP Intelligence Platform Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Closing the Exploitation Gap July 22, 2026 Join this live webinar as we explore why exploitation is outpacing remediation, where risk is growing fastest, and what security leaders can do to close the gap before attackers take advantage. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveThe Department of Energy has appointed Andrew McClure as Director of the Office of Cybersecurity, Energy Security, and Emergency Response (CESER).Sumo Logic has appointed Chris Malone as CEO and Conor Burns as CFO.Nozomi Networks has appointed co-founder Andrea Carcano as CEO.More People On The MoveExpert Insights Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Legacy Systems, Real-World Impacts: The Reality of OT Security Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts. (Tod Beardsley) The Shift Toward Business-Aligned Risk Management Moving from isolated, technical data to a continuous risk lifecycle can help organizations align security controls with actual business consequences. (Steve Durbin) How to Conduct a Successful Audit of AI-Driven Software Development As AI-generated code becomes commonplace, CISOs need new audit strategies to measure developer practices, govern AI tool usage, and identify software risks before they reach production. (Matias Madou) Flipboard Reddit Whatsapp Whatsapp Email

Entities