Google Patches 41 Security Flaws in Chrome 151, Six Rated Critical
The latest Chrome update fixes a cluster of memory-safety bugs that could let attackers crash your browser or run malicious code on your device. Here is what happened and what you should do.
Key points
- Google released Chrome version 151.0.7922.108/.109 on Thursday, fixing 41 security flaws rated critical or high severity.
- Six flaws are rated critical, including five use-after-free bugs (a type of memory error where a program keeps using data it has already deleted, which attackers can manipulate to hijack the software) in WebGL, Aura, Skia, and Views.
- A sixth critical flaw is an out-of-bounds write in the ANGLE graphics engine, meaning the software can be tricked into writing data outside its reserved memory space, potentially allowing attackers to run their own code.
- Google says none of the 41 vulnerabilities are known to be actively exploited right now.
- The update is available for Windows, macOS, and Linux.
Google has pushed out a sizeable security update for its Chrome browser, patching 41 flaws that researchers and Google's own engineers found across the browser's graphics and interface layers.
How serious are these flaws?
Six are rated critical, the highest possible severity. That means a criminal who crafted a malicious webpage could, in theory, crash your browser or silently run software on your machine just by getting you to visit it.
Five of the critical bugs are use-after-free issues, a class of memory error where a program keeps reaching for data it has already freed up. Think of it as a filing clerk who hands out a folder, marks it as returned, then accidentally gives someone else access to the same drawer. The affected components are WebGL (Chrome's tool for rendering 3D graphics), Aura and Views (parts of Chrome's interface), and Skia (the drawing library that renders text and images on screen).
The sixth critical flaw sits in ANGLE, Google's graphics translation layer. It is an out-of-bounds write, where the software can be pushed into scribbling data outside the memory space it is supposed to touch.
The remaining 35 flaws are all rated high severity. Google found 25 of them internally. External researchers reported the other 10; Google has so far disclosed two bounty payments, both $500 each.
What types of bugs are in the other 35 flaws?
The bulk are memory-safety bugs, 24 in total, covering buffer overflows (where more data is crammed into a container than it can hold), further use-after-free errors, and uninitialized use flaws (where the browser acts on data before it has been properly set up). The rest involve race conditions, integer overflows, and insufficient checks on untrusted input.
| Severity | Count | Example flaw types |
|---|---|---|
| Critical | 6 | Use-after-free, out-of-bounds write |
| High (memory safety) | 24 | Buffer overflow, uninitialized use |
| High (other) | 11 | Race conditions, integer overflows, bad input validation |
Google noted, as first reported by SecurityWeek, that its increasing use of AI tools has helped accelerate how quickly it can find and fix these issues.
What should Chrome users do?
Update Chrome now. The patched versions are 151.0.7922.108/109 for Windows and macOS, and 151.0.7922.108 for Linux. Chrome usually updates itself in the background, but you can check manually by clicking the three-dot menu in the top-right corner, selecting Help, then About Google Chrome. If an update is available, it will download and install. Restart the browser once it finishes.
No exploitation of these flaws in the wild has been reported. Even so, memory-safety bugs in browsers are a favourite target for criminals, and the gap between a patch arriving and someone reverse-engineering it to build an attack is often short. Do not wait.
