Google Patches 370 Security Flaws in Chrome 151, Including Seven Critical Bugs
The browser update is one of Google's largest single releases of the year, fixing flaws that could let attackers take control of your browser or crash it entirely.
Key points
- Google released Chrome 151 on Wednesday, patching 370 security vulnerabilities across all platforms.
- Seven flaws were rated critical, meaning attackers could exploit them to take over a browser without the user doing anything wrong.
- Thirty of the patched bugs sit inside ANGLE, the graphics engine Chrome uses to display images and video.
- Google paid $58,500 in bug bounty rewards, money paid to independent researchers who responsibly report security flaws, for 21 externally reported issues.
- Chrome 151 brings Google's total patched vulnerabilities for the year past 1,800.
Google pushed a major security update to its Chrome browser on Wednesday, fixing 370 vulnerabilities, including seven rated critical. Critical means an attacker could exploit the flaw remotely and without the victim clicking anything suspicious.
What kinds of flaws were fixed?
Four of the seven critical bugs are a type called use-after-free, where the browser accidentally reuses a piece of computer memory it has already freed, creating an opening attackers can slip through. These four appear in Chrome components handling screen compositing (how layers of a webpage are assembled), the Views interface framework, the Skia drawing library, and the Ozone display system.
Two more critical flaws involve insufficient validation of untrusted input, meaning the browser failed to properly check data coming in from outside before acting on it. Both sit inside Dawn and ANGLE, the systems Chrome uses to process graphics. The seventh critical bug is a race condition in Chrome's Updater, where two processes run at the same time and trip over each other in a way that attackers can exploit.
Beyond the critical tier, the update addresses 71 high-severity flaws. A dozen or more of those are also use-after-free bugs, spread across the parts of Chrome that handle navigation, JavaScript execution, file transfers, audio, and the browser's own update mechanism.
| Severity | Number of flaws patched |
|---|---|
| Critical | 7 |
| High | 71 |
| Medium | 170 |
| Low | 122 |
Thirty of the total 370 patches target ANGLE, short for Almost Native Graphics Layer Engine, the open-source component Chrome relies on to render all graphics. That concentration in a single component is worth noting: it suggests ANGLE received a focused security audit in this cycle.
Should everyday Chrome users do anything?
Yes, one small thing: check that your browser updated. Chrome updates automatically for most people, but you can confirm by opening the menu in the top-right corner, choosing Help, then About Google Chrome. The patched version is 151.0.7922.71 on Linux, and 151.0.7922.71 or .72 on Windows and macOS. If you see a lower number, click the update button.
Google told SecurityWeek it found 349 of the 370 flaws through its own internal research. External security researchers reported 21, earning a combined $58,500 in bounty payments, though Google has not yet disclosed the exact amounts for 13 of those reports.
With this release, Google has patched more than 1,800 Chrome vulnerabilities so far this year. That figure sounds alarming, but it largely reflects an aggressive internal testing programme rather than an unusually flawed product.
