Google Rushes Out Chrome 150 to Close Seven Memory Safety Holes
Google has shipped a fresh security update for its Chrome browser, version 150, addressing a cluster of seven memory safety bugs. Among them are three critical-severity use-after-free vulnerabilities — the kind attackers love to weaponize.
The update lands as versions 150.0.7871.128/.129 for Windows and macOS, and 150.0.7871.128 for Linux. Users on all platforms should grab it now.
Critical Flaws Found in CameraCapture, GPU, and Network Components
Three of the most dangerous bugs are use-after-free issues in Chrome’s CameraCapture, GPU, and Network subsystems. All carry a critical severity rating. Google’s own security team discovered each of them.
Use-after-free flaws are a classic memory corruption pattern. They occur when a program continues to use a pointer after the associated memory has been freed. An attacker can exploit that dangling reference to execute arbitrary code, crash the browser, or steal data.
Google has been hammering away at this class of bug for years. The company has invested heavily in memory-safe languages like Rust and in compiler hardening to reduce the attack surface. Still, these vulnerabilities keep cropping up.
High-Severity Use-After-Free Bugs in Cast, Ozone, and Aura
Beyond the critical trio, the Chrome 150 update also fixes three high-severity use-after-free flaws. They live in the Cast, Ozone, and Aura components. Again, Google’s internal researchers found them.
Cast handles media streaming to Chromecast devices. Ozone is the abstraction layer for windowing systems on Linux and ChromeOS. Aura is the desktop window manager that draws the browser chrome itself. A bug in any of these could give an attacker a foothold.
V8 Engine Bug Found by OpenAI Codex Security
The seventh vulnerability is different. It’s an out-of-bounds read and write flaw in Chrome’s V8 JavaScript engine. And it wasn’t found by Google — it was discovered by OpenAI Codex Security, the AI-driven code analysis platform.
Out-of-bounds bugs let an attacker read or write memory beyond the allocated buffer. That’s a classic stepping stone to code execution. Google says it hasn’t yet determined the bug bounty payout for this finding.
OpenAI Codex Security is part of a growing trend: using large language models to audit source code for vulnerabilities. The results so far are mixed, but this discovery suggests the approach is starting to pay off.
No Signs of Active Exploitation — But Don’t Wait
Google’s advisory makes no mention of any of these bugs being exploited in the wild. That’s the good news. The bad news: memory safety bugs in Chrome have been a favorite target for attackers, including state-sponsored groups. Exploit code for similar flaws often appears within days of a patch.
The company has patched over 1,400 Chrome vulnerabilities since April, hundreds of them memory safety issues. Many were found by Google itself, likely through automated fuzzing and AI-assisted scanning. That volume underscores just how hard it is to write safe C++ code at Chrome’s scale.
For a deeper dive into recent browser security trends, check out our coverage of the critical vulnerabilities patched in Chrome 150 and Firefox 152.
How to Update Your Browser
Chrome updates roll out automatically in the background. But you can force the update to get the fix immediately:
- Click the three-dot menu in the top-right corner.
- Go to Help > About Google Chrome.
- Chrome will check for updates and install the latest version.
- Click Relaunch to complete the process.
After the update, your browser should report version 150.0.7871.128 or later. If you’re an IT admin managing Chrome across an organization, deploy the update via Group Policy or your MDM tool as soon as possible.
Memory safety bugs aren’t going away. But with each update, Google chips away at the problem. The Chrome 150 patch is the latest reminder: update early, update often.
For more on how memory safety vulnerabilities are being exploited in the real world, read our report on WP2Shell WordPress vulnerabilities exploited in the wild.
