Google Chrome 151 Patches 41 Security Flaws, Including Six Critical Memory Bugs
Google Chrome 151 has been released, addressing 41 security vulnerabilities, with a particular focus on six critical memory-safety flaws that could lead to browser crashes, corruption, or code execution.
Google has rolled out version 151 of its Chrome browser to the Stable channel, delivering patches for a total of 41 security vulnerabilities. Among these, six are classified as critical and relate to memory safety, posing a significant risk of browser crashes, memory corruption, or even arbitrary code execution if exploited.
The update, version 151.0.7922.108/.109, is progressively being distributed to Windows and macOS users, while Linux users will receive version 151.0.7922.108. Google advises all users to update their browsers as soon as the new version becomes available to mitigate these risks.
The most severe vulnerabilities patched in this release are use-after-free bugs. These types of flaws occur when a program attempts to access memory that has already been deallocated. Attackers can leverage such weaknesses by luring unsuspecting users to specially crafted websites or malicious web content.
Specifically, two critical use-after-free vulnerabilities have been identified in WebGL, Chrome's technology for rendering 2D and 3D graphics. These are tracked as CVE-2026-19137 and CVE-2026-19170. The former was reported anonymously, while the latter was discovered by researchers from STAR Labs SG Pte. Ltd.
Further critical issues include CVE-2026-19149, a use-after-free bug within Aura, Chrome's user interface framework. Additionally, CVE-2026-19154, a use-after-free vulnerability in the Skia graphics library, and CVE-2026-19172, a similar flaw in Views, another component of Chrome's interface, have been resolved. Google also addressed CVE-2026-19157, an out-of-bounds write vulnerability in ANGLE, the graphics translation layer used by Chrome.
Beyond the critical flaws, the update also rectifies 35 high-severity vulnerabilities affecting a wide array of browser components. These include the V8 JavaScript engine, GPU process, HTML renderer, media subsystem, Web Authentication implementation, extensions platform, payment features, translation service, workers, codecs, navigation handling, and crash-reporting functions. Many of these high-severity issues are also memory-related, encompassing heap buffer overflows, out-of-bounds writes, integer overflows, and the use of uninitialized memory.
Google has opted to withhold detailed technical information and proof-of-concept exploits for these vulnerabilities until a substantial portion of users have updated their browsers. This strategy aims to minimize the window of opportunity for malicious actors to exploit unpatched systems. Users can initiate an update by navigating to the Chrome menu, selecting 'Help,' and then choosing 'About Google Chrome.'
Organizations are strongly encouraged to prioritize the deployment of Chrome 151 across managed Windows, macOS, and Linux endpoints to bolster their defenses against these significant browser vulnerabilities.