Google has released Chrome 151 to the stable channel, along with an extensive security patch package that addresses a total of 382 vulnerabilities . These include 15 critical security holes , which, under certain conditions, can be exploited by cybercriminals to remotely execute malicious code and potentially completely compromise the browser .
The update is available for Windows, macOS, Linux , and Chrome for iOS, covering nearly every major subsystem of the browser. Google recommends users install the new version as soon as possible, as several of the fixes address vulnerabilities that could be used in targeted attacks.
382 fixes in a single update cycle
According to Google, version 150.0.7871.46 for desktop incorporates 382 separate fixes, most of which came through the Chrome Vulnerability Reward Program.
See also: Adobe: Urgent security updates for ColdFusion and Campaign Classic
As with any major security update, the company did not disclose all the technical details of the vulnerabilities. This practice is followed to give most users time to install the update before the information becomes publicly available and mass attacks are attempted.
Chrome 151: The most dangerous security vulnerabilities
Of the total number of fixes, 15 are rated as critical. Most of them are related to use-after-free, a class of vulnerabilities that occurs when a program attempts to use a memory segment that has already been freed. These weaknesses have long been one of the main targets of attackers, as they can lead to memory corruption and ultimately to arbitrary code execution.
The issues are located in critical Chrome subsystems, such as Extensions , GPU , WebUSB , Bluetooth , Chromoting , Views , and the Ozone environment , which is used to manage graphics across different operating systems.
In the event of a successful exploitation, a user may become infected simply by visiting a specially crafted website or interacting with malicious content.
Risk of bypassing the sandbox
Of particular concern is the fact that several of the vulnerabilities can be used as part of exploit chains.
By combining several different bugs, attackers could bypass sandbox , the key isolation mechanism that prevents a malicious website from accessing the rest of the operating system.
At the same time, problems were fixed in subsystems such as Dawn, ANGLE and Skia, which are related to graphics rendering, as well as in iOSWeb, where cases of insufficient input data control were identified.
These vulnerabilities could be exploited to corrupt the heap, bypass security mechanisms, or even control the flow of program execution.
Dozens more high-severity vulnerabilities
In addition to the critical bugs, Google addressed a large number of high-risk vulnerabilities affecting features such as Chromecast , the QUIC protocol , Chrome's update mechanism , Safe Browsing , SVG , Canvas , accessibility , Chrome for iOS , and file import.
See also: iOS 26.5.2, Safari 26.5.2: Apple fixes serious vulnerabilities
In many cases, these are use-after-free, heap buffer overflow, integer overflow, or insufficient policy enforcement issues , which can facilitate the disclosure of sensitive information or even the escalation of access rights.
These fixes are considered particularly important for corporate environments, where Chrome is used on thousands of workstations and is a key daily productivity tool.
Overall browser security is enhanced
The new release also includes hundreds of moderate and low-severity fixes affecting features such as WebAuthn, WebXR, WebHID, developer tools, password management, PDF Viewer, fonts, browsing history, data storage system, and several new features that leverage artificial intelligence.
Although each individually is not considered particularly dangerous, experts point out that such weaknesses can be combined with more serious security gaps, significantly increasing the chances of a successful attack.
For this reason, major software manufacturers place special emphasis on even seemingly small fixes.
How the vulnerabilities were discovered
A significant portion of the problems were not reported by third-party researchers but were identified by Google's own security teams.
The company leveraged advanced memory analysis tools, such as AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, as well as fuzzing, which subject the software to a huge number of unpredictable inputs with the aim of uncovering hidden bugs.
The continuous use of automated tools is now a key pillar of Chrome development, helping to identify vulnerabilities before they reach the hands of cybercriminals.
See also: F5 fixes two critical bugs in NGINX Open Source
What users should do
Installing Chrome 151 is the most effective defense against these vulnerabilities. Most users will receive the update automatically, but it is recommended to manually check if they are running the latest version.
For businesses, experts recommend immediately deploying the update to all managed computers, reviewing security policies for browser extensions, enabling automatic updates , and leveraging features like Safe Browsing and Site Isolation. In an era where browser-based attacks are constantly increasing, timely installation of each security update remains one of the most effective protection measures for both individuals and organizations.
