Google Releases Patches for 370 Vulnerabilities in Chrome 151

Written by

Google’s Chrome security team has released security patches for 370 vulnerabilities affecting the browser, including seven critical ones.

The patches were announced on July 29 as part of a Chrome update to version 151 for Windows, Mac (151.0.7922.71/.72) and Linux (151.0.7922.71).

Among the seven critical vulnerabilities are issues involving ‘use after free’ in various components such as Compositing, Views, Skia and Ozone.

Other vulnerabilities related to insufficient validation of untrusted input in Dawn and Almost Native Graphics Layer Engine (ANGLE) – an open-source tool that translates OpenGL ES graphics code into other formats like Vulkan, DirectX or Metal to help programs and web browsers run 3D graphics smoothly on different computers and phones without needing special drivers – as well as a race condition in the Updater.

These critical vulnerabilities were reported by Google's security team between May 18 and June 14, 2026.

The critical vulnerabilities, identified by their respective CVE numbers, are as follows:

  • CVE-2026-17650: Use after free in Compositing (reported on May 18, 2026)
  • CVE-2026-17651: Insufficient validation of untrusted input in Dawn (reported on May 28, 2026)
  • CVE-2026-17652: Use after free in Views (reported on June 2, 2026)
  • CVE-2026-17653: Use after free in Skia (reported on June 5, 2026)
  • CVE-2026-17654: Race in Updater (reported on June 10, 2026)
  • CVE-2026-17655: Insufficient validation of untrusted input in ANGLE (reported on June 11, 2026)
  • CVE-2026-17656: Use after free in Ozone (reported on June 14, 2026)

The update also includes fixes for 71 high-severity, 170 medium-severity and 122 low-severity security issues.

Security researchers have netted a combined $58,500 for uncovering these flaws as part of the firm’s bug bounty program. However, payout specifics for 13 bugs have yet to be made public.

“We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel,” Google said in its update.

Image credits: Parinussa Revy / viewimage / Shutterstock.com

Read now: Google Issues Emergency Patch for Fourth Chrome Zero-Day of 2025

What’s Hot on Infosecurity Magazine?