Chrome 151 Fixes 41 Vulnerabilities, Including Six Critical Flaws

An Update Addressing Numerous Memory-Safety Issues

Google has released Chrome 151 with fixes for 41 vulnerabilities: six rated critical and 35 rated high severity.

More than two dozen of the issues involve memory safety. Successful exploitation could result in data corruption, browser crashes, or arbitrary code execution.

Google is not aware of any attacks exploiting these flaws in the wild.

The Six Critical Vulnerabilities

Five critical vulnerabilities are use-after-free flaws affecting the WebGL, Aura, Skia, and Views components. These bugs can cause memory to be accessed after it has been freed, creating opportunities for data manipulation or code execution.

The sixth vulnerability is an out-of-bounds write in the ANGLE graphics engine.

Two WebGL flaws were reported by external researchers. Google has not yet disclosed the associated bug bounties. Its own researchers identified the other four critical vulnerabilities.

The High-Severity Vulnerabilities

Google discovered 25 of the 35 high-severity vulnerabilities, while external researchers reported 10. The company has disclosed only two rewards, both worth $500.

Twenty-four high-severity flaws affect memory handling. They include use-after-free, buffer overflow, out-of-bounds write, and use of uninitialized data vulnerabilities.

The remaining issues include insufficient validation of untrusted input, incorrect implementations, race conditions, and integer overflows.

Fixed Versions and Recommended Actions

The updated versions are:

• Windows and macOS: Chrome 151.0.7922.108 and 151.0.7922.109
• Linux: Chrome 151.0.7922.108

Users should install the update without delay and verify under Settings > About Chrome that the new version is active. On managed devices, administrators should also check the status of the centralized deployment.

Until the update is complete, users should watch for unusual crashes, unexpected browser closures, and other abnormal behavior. No specific indicators of compromise have been reported.