Google Patches 370 Security Flaws in Chrome 151, Including Seven Critical Bugs
The browser update is one of Google's largest single releases of the year, fixing flaws that could let attackers take control of your browser or crash it entirely.
Key points
- Google released Chrome 151 on Wednesday, patching 370 security vulnerabilities across all platforms.
- Seven flaws were rated critical, meaning attackers could exploit them to take over a browser without the user doing anything wrong.
- Thirty of the patched bugs sit inside ANGLE, the graphics engine Chrome uses to render all graphics.
- Google paid $58,500 in bug bounty rewards to independent researchers for 21 externally reported issues.
- Chrome 151 brings Google's total patched vulnerabilities for the year past 1,800.
Google pushed a major security update to its Chrome browser on Wednesday, fixing 370 vulnerabilities, including seven rated critical. Critical means an attacker could exploit the flaw remotely, without the victim clicking anything suspicious.
What kinds of flaws were fixed?
Four of the seven critical bugs are use-after-free flaws, where the browser accidentally reuses a piece of memory it's already freed, creating an opening attackers can slip through. These four appear in Chrome components handling screen compositing, the Views interface framework, the Skia drawing library, and the Ozone display system. We've tracked use-after-free bugs across six stories in the last 90 days, and Chrome 150 carried three of its own last month.
Two more critical flaws involve insufficient validation of untrusted input in Dawn and ANGLE, the systems Chrome uses to process graphics. The seventh critical bug is a race condition in Chrome's Updater, where two processes collide in a way that can be exploited.
Beyond the critical tier, the update addresses 71 high-severity flaws. A dozen or more are also use-after-free bugs spread across Chrome's navigation, JavaScript engine (V8), file transfer handling, audio, and updater components.
| Severity | Number of flaws patched |
|---|---|
| Critical | 7 |
| High | 71 |
| Medium | 170 |
| Low | 122 |
Thirty of the 370 patches target ANGLE, short for Almost Native Graphics Layer Engine, the open-source component Chrome relies on to render graphics. That concentration in a single component suggests it received a focused security audit this cycle. It's the kind of pattern worth watching: when one subsystem absorbs that many fixes at once, the next release often carries follow-on patches.
Should everyday Chrome users do anything?
Yes, one small thing: confirm your browser updated. Chrome updates automatically for most people, but you can check by opening the menu in the top-right corner, choosing Help, then About Google Chrome. The patched version is 151.0.7922.71 on Linux and 151.0.7922.71 or .72 on Windows and macOS. A lower number means click update.
Google told SecurityWeek it found 349 of the 370 flaws through its own internal research. External researchers reported 21, earning $58,500 in bounty payments, though Google hasn't yet disclosed the exact amounts for 13 of those reports.
With this release, Google's patched more than 1,800 Chrome vulnerabilities so far this year. That figure sounds alarming, but it largely reflects an aggressive internal testing programme rather than an unusually flawed product. The real concern isn't the count; it's the seven that could have let someone in without a single click from you.
