The update began rolling out on July 29 for Windows, macOS and Linux. Chrome 151.0.7922.71 and 151.0.7922.72 are being distributed to Windows and Mac devices, while Linux systems are receiving version 151.0.7922.71. The Android release, carrying the same core security fixes, is being made available through Google Play.
Four of the critical vulnerabilities are use-after-free defects affecting Chrome’s Compositing, Views, Skia and Ozone components. Such weaknesses arise when software continues to access memory after it has been released, creating an opportunity for attackers to corrupt data, crash the browser or potentially execute malicious code.
Two other critical flaws involve insufficient validation of untrusted input in Dawn and ANGLE, technologies used in graphics processing and web rendering. The seventh is a race condition in Chrome’s updater, where the timing of competing operations could lead to unsafe behaviour.
The critical flaws have been assigned identifiers CVE-2026-17650 through CVE-2026-17656. Access to detailed technical information remains restricted while the patches are distributed, a standard safeguard designed to prevent attackers from exploiting the defects before most users have updated.
Chrome 151 also addresses 71 high-severity vulnerabilities. These include problems in V8, Navigation, Loader, Site Isolation, Autofill, Passwords, Web Authentication, PDF handling, audio processing, downloads and enterprise functions.
The high-risk defects cover a wide range of technical weaknesses, including out-of-bounds reads and writes, integer overflows, type confusion, cryptographic errors, uninitialised memory use, policy bypasses and failures to validate untrusted data. Some could be exploited through specially crafted websites or content, although successful attacks would depend on the affected component and security protections surrounding it.
Among the externally reported flaws is a high-severity use-after-free vulnerability in Chrome’s Navigation component. Its finder received a $36,000 bug bounty. Another high-severity defect in the V8 JavaScript engine was reported by Duc Nguyen of Calif. io in collaboration with OpenAI Codex Security and attracted a $1,000 reward.
The update contains 170 medium-severity fixes and 122 low-severity patches. Thirty of the corrected weaknesses affect ANGLE, the graphics translation layer used by Chrome to support WebGL and other rendering functions across different operating systems and hardware.
Google identified 349 of the 370 vulnerabilities through its internal security work, while outside researchers reported 21. At least $58,500 has been awarded through the company’s vulnerability reward programme, with payments for several additional reports yet to be disclosed.
The scale of the Chrome 151 update reflects a sharp rise in the number of weaknesses being detected inside the browser’s expanding code base. Google has fixed more than 1,800 Chrome vulnerabilities since the start of 2026, including hundreds patched during major version upgrades.
Chrome 150, released at the end of June, corrected 382 security flaws, including 15 rated critical. The successive large updates have placed added pressure on companies to accelerate browser patching, particularly where Chrome is installed across thousands of managed endpoints.
Security teams increasingly regard browsers as high-value targets because they handle passwords, authentication tokens, payment details, corporate applications and sensitive communications. A browser flaw can provide an initial path into a system even when operating systems and traditional business software are fully patched.
Chrome normally updates automatically when users restart the browser. Users can also trigger the process by opening the main menu, selecting Help and then About Google Chrome. The browser checks for the latest version and requests a relaunch after installation.
Companies using centralised management tools may need to confirm that the update has reached all endpoints, including laptops that remain offline for extended periods. Administrators may also consider forcing a browser restart where employees habitually leave Chrome running with multiple tabs open.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
