Critical Vulnerabilities Patched With Chrome 151 Update

Summary

Google has released Chrome version 151, addressing 41 vulnerabilities, including six critical-severity flaws. Five of these critical issues are use-after-free bugs in components like WebGL and Aura, and one is an out-of-bounds write in the ANGLE graphics engine. The update also resolves 35 high-severity flaws, many of which are memory safety bugs.

Full text

Google on Thursday rolled out a fresh Chrome 151 update that patches 41 critical- and high-severity vulnerabilities. Over two dozen security defects are memory safety bugs that could lead to data corruption, crashes, and arbitrary code execution. The latest Chrome update resolves six critical-severity flaws, including five use-after-free issues in WebGL, Aura, Skia, and Views, and an out-of-bounds write in the ANGLE graphics engine. Google credited external researchers for finding the two WebGL security defects, but has yet to determine the bug bounty rewards for them. The other four weaknesses were found by Google. All the remaining 35 vulnerabilities resolved with the Chrome refresh are high-severity flaws. Google discovered 25 of them and credited external researchers for the other 10, but disclosed only two of the rewards it has handed out, both of $500. Of the 35 issues, 24 are memory safety bugs, including use-after-free, buffer overflow, out-of-bounds write, and uninitialized use defects.Advertisement. Scroll to continue reading. The remaining flaws include insufficient validations of untrusted input, inappropriate implementations, race conditions, and integer overflows. While the new Chrome update does not include as many fixes as most of the recent browser refreshes, it does show that Google’s use of AI drives a faster patching pace. The latest Chrome iteration is now rolling out as versions 151.0.7922.108/.109 for Windows and macOS, and as version 151.0.7922.108 for Linux. While Google makes no mention of any of these vulnerabilities being exploited in the wild, users are advised to update their browsers as soon as possible. Related: Chrome 151 Patches 370 Vulnerabilities Related: Critical Paperclip Flaw Allowed Admin Access, Code Execution Related: Cisco Patches Critical SD-WAN, IOS XE, FMC Vulnerabilities Related: Hackers Start Exploiting Recent JetBrains TeamCity Vulnerability Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Hackers Start Exploiting Recent JetBrains TeamCity Vulnerability311,000 Impacted by Brown Health Medical Group-MA Data BreachAI Agents Targeted Real People and Projects During Cybersecurity TestsCISA Warns of Exploited Langflow, N-central, and Tomcat VulnerabilitiesOver 400 NPM Packages Infected in ChainDrop Supply Chain AttackOligo Raises $60 Million for Runtime SecurityZenity Raises $125 Million in Series C FundingGemini Agent-to-Agent Attack Method Exposed Secrets, Enabled Pull Request Tampering Latest News 3.8 Million Impacted by Unlimited Technology Systems Data BreachSnowflake Hacker Pleads Guilty in US CourtZero-Click AI Browser Hacking: Claude and ChatGPT Atlas Hijacked via Emails, X PostsPodcast: Compliance Won’t Save You: The Future of Cyber Risk with Edna ConwayCritical Paperclip Flaw Allowed Admin Access, Code ExecutionMeta AI Hacked External Systems During Cybersecurity TestingBelarusian Ransom Cartel Mastermind Gets 16 Years in PrisonCisco Patches Critical SD-WAN, IOS XE, FMC Vulnerabilities Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveServiceNow has appointed Simon Mouyal as Chief Marketing Officer.James Wilkinson has been named Chief Information Security Officer for the City of Dallas.PNC Financial Services Group has appointed Christian Winward as CISO.More People On The MoveExpert Insights Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Legacy Systems, Real-World Impacts: The Reality of OT Security Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts. (Tod Beardsley) Flipboard Reddit Whatsapp Whatsapp Email

Entities