Google Patches Seven Memory Safety Bugs in Chrome 150, Three Rated Critical
All seven flaws were found internally or by researchers, not by criminals. But history says patch fast anyway.
Key points
- Google released Chrome version 150.0.7871.128/.129 in the week of July 2025, fixing seven security flaws.
- Three of the seven bugs are rated critical, meaning a criminal could use them to take control of a victim's computer.
- All seven flaws were found by Google or friendly researchers before any known criminal use.
- Since April 2025, Google has patched more than 1,400 Chrome vulnerabilities in total.
- OpenAI Codex Security discovered one of the seven bugs, in Chrome's JavaScript engine.
Google has pushed a fresh update to Chrome, its web browser used by roughly two thirds of the world's internet users, closing seven security holes that researchers found before criminals could exploit them. The update carries version numbers 150.0.7871.128 and 150.0.7871.129 on Windows and macOS, and 150.0.7871.128 on Linux.
Five of the seven bugs are a type called use-after-free, which is a memory flaw where a program keeps using a piece of computer memory it has already released, like writing on a sticky note after you have handed it to someone else. If a criminal triggers this at the right moment, they can plant their own instructions inside your computer instead.
Three of those use-after-free flaws sit in Chrome's CameraCapture, GPU, and Network components and each earned a critical rating, the most severe on the scale. The other two sit in Cast (the screen-mirroring feature), Ozone, and Aura, which are parts of Chrome's display layer, and are rated high severity.
The seventh bug is in V8, the JavaScript engine, meaning the part of Chrome that runs the interactive code behind almost every website. This one can read or write data outside the boundaries where it is supposed to operate, which is another path an attacker could walk through to run malicious code on your machine. OpenAI Codex Security found it and reported it responsibly; Google has not yet decided on a reward payment.
Should ordinary Chrome users be worried?
Not today, because Google says there is no evidence any of these bugs have been used in real attacks. That said, once a patch ships, the details of the underlying flaw become easier to reverse-engineer, so the window between "patch released" and "criminals trying to use it" has historically been short.
The practical move is simple: let Chrome update itself. Most people will get the new version automatically within a day or two. To force it now, open Chrome's menu (the three dots, top right), choose Help, then About Google Chrome. If an update is waiting, it will install when you restart the browser.
Google says it has been rewriting parts of Chrome in Rust, a programming language designed to prevent exactly this category of bug from existing in the first place. That work is ongoing. Since April 2025 the company has fixed more than 1,400 Chrome vulnerabilities, with most of the discoveries attributed to internal AI-assisted testing.
The failure mode here is not exotic. Browser flaws exploited through a single malicious web page are a classic entry point for criminal campaigns targeting both individuals and corporate networks.
Restart your browser today; it costs thirty seconds and closes three critical holes.
