Google Patches 41 Security Flaws in Chrome 151, Six Rated Critical
The latest Chrome update fixes a cluster of memory-safety bugs that could let attackers crash your browser or run malicious code on your device. Here is what happened and what you should do.
Key points
- Google released Chrome version 151.0.7922.108/.109 on Thursday, fixing 41 security flaws rated critical or high severity.
- Six flaws are rated critical, including five use-after-free bugs (a type of memory error where a program keeps using data it has already deleted, which attackers can manipulate to hijack the software) in WebGL, Aura and Views, and Skia.
- A sixth critical flaw is an out-of-bounds write in the ANGLE graphics engine, meaning the software can be tricked into writing data outside its reserved memory space, potentially allowing attackers to run their own code.
- Google says none of the 41 vulnerabilities are known to be actively exploited right now.
- The update is available for Windows, macOS and Linux.
Google has pushed out a sizeable security update for its Chrome browser, patching 41 flaws that researchers and Google's own engineers found across the browser's graphics and interface layers.
How serious are these flaws?
Six are rated critical, the highest possible severity. A criminal who crafted a malicious webpage could crash your browser or silently run software on your machine just by getting you to visit it.
Five of the critical bugs are use-after-free issues, a class of memory error where a program keeps reaching for data it has already freed up. Think of it as a filing clerk who hands out a folder, marks it as returned, then accidentally gives someone else access to the same drawer. The affected components are WebGL (Chrome's tool for rendering 3D graphics), Aura and Views (parts of Chrome's interface), and Skia (the drawing library that renders text and images on screen). Google credited external researchers with finding the two WebGL flaws; the other three were found internally.
The sixth critical flaw sits in ANGLE, Google's graphics translation layer, which we've covered twice since 30 July, including our earlier report on Chrome 151. It's an out-of-bounds write, where the software can be pushed into scribbling data outside the memory space it's supposed to touch.
What types of bugs are in the other 35 flaws?
24 of the remaining 35 are memory-safety bugs: buffer overflows (where more data is crammed into a container than it can hold), further use-after-free errors, and uninitialized use flaws (where the browser acts on data before it's been properly set up). The other 11 cover race conditions, integer overflows and bad input validation.
| Severity | Count | Example flaw types |
|---|---|---|
| Critical | 6 | Use-after-free, out-of-bounds write |
| High (memory safety) | 24 | Buffer overflow, uninitialized use |
| High (other) | 11 | Race conditions, integer overflows, bad input validation |
Google found 25 of the 35 high-severity flaws internally. External researchers reported the other 10; Google has disclosed two bounty payments so far, both $500.
What should Chrome users do?
Update now. The patched versions are 151.0.7922.108/109 for Windows and macOS, and 151.0.7922.108 for Linux. Chrome usually updates itself in the background, but you can check manually: click the three-dot menu, select Help, then About Google Chrome. Restart the browser once it finishes.
No exploitation in the wild has been reported. Even so, the gap between a patch landing and someone reverse-engineering it to build an attack is often short. Don't wait.
Should you worry?
The honest answer is: less than the critical ratings suggest, but more than zero. None of these bugs are being actively used right now. That said, memory-safety flaws in browser graphics layers are exactly what well-resourced attackers go looking for, because a single malicious webpage is all it takes.
