Google’s biggest Chrome security update of the year just landed
On July 29, Google dropped patches for a staggering 370 security vulnerabilities in Google Chrome. That’s not a typo — three hundred and seventy flaws, seven of them rated critical. The update pushes the browser to version 151 for Windows, Mac (151.0.7922.71/.72), and Linux (151.0.7922.71).
For context, the typical monthly Chrome update addresses somewhere between 20 and 50 bugs. This one is nearly ten times that. It’s the kind of patch cycle that makes security teams sit up — and makes you want to check your browser version right now.
What’s inside the Chrome 151 patch: 7 critical CVEs
The seven critical vulnerabilities all involve memory management or input validation issues. Google’s internal security researchers reported them between May 18 and June 14, 2026. Here’s the breakdown:
- CVE-2026-17650 — Use after free in Compositing (reported May 18)
- CVE-2026-17651 — Insufficient validation of untrusted input in Dawn (May 28)
- CVE-2026-17652 — Use after free in Views (June 2)
- CVE-2026-17653 — Use after free in Skia (June 5)
- CVE-2026-17654 — Race condition in the Updater (June 10)
- CVE-2026-17655 — Insufficient validation of untrusted input in ANGLE (June 11)
- CVE-2026-17656 — Use after free in Ozone (June 14)
“Use after free” bugs are a classic memory corruption pattern. A program tries to access memory after it’s been freed, which can let an attacker run arbitrary code. They’re the kind of flaw that browser makers dread — and that exploit developers love.
Dawn and ANGLE: The graphics pipeline under scrutiny
Two of the critical bugs hit graphics-related components. CVE-2026-17651 targets Dawn, Google’s WebGPU implementation. CVE-2026-17655 affects ANGLE, the open-source translation layer that converts OpenGL ES calls into Vulkan, DirectX, or Metal. ANGLE is what lets Chrome run 3D graphics smoothly across different hardware without requiring special drivers. A flaw there could potentially allow an attacker to corrupt GPU memory or crash the renderer.
The Updater race condition (CVE-2026-17654) is worth noting too. The auto-update mechanism is a critical part of Chrome’s security posture — a bug in the updater itself is the kind of irony that keeps security engineers up at night.
By the numbers: 71 high, 170 medium, 122 low
Beyond the critical seven, the patch batch includes 71 high-severity fixes, 170 medium-severity patches, and 122 low-severity corrections. That’s a lot of ground covered. Some of the medium-severity bugs might sound less scary, but in combination with other flaws, they can become dangerous. Google doesn’t release full technical details for most bugs until users have had time to update.
Security researchers who reported these flaws collected a combined $58,500 through Google’s bug bounty program. However, the company hasn’t disclosed payout details for 13 of the bugs yet — possibly because some are still under review or involved higher-tier rewards.
How to update Chrome right now
If you haven’t updated yet, here’s what to do:
- Click the three-dot menu in the top-right corner of Chrome
- Go to Help → About Google Chrome
- Chrome will automatically check for updates and install version 151
- Restart the browser to complete the update
That’s it. The whole thing takes about two minutes. Given the scale of this patch, it’s time well spent.
This update follows a busy year for Chrome security. In 2025, Google issued multiple emergency patches for Chrome zero-day vulnerabilities, including one in January and another in March. While this July update doesn’t mention any zero-days being actively exploited, the sheer volume of fixes suggests the Chrome security team has been working overtime.
Google’s message: Prevention, not just reaction
In its release notes, Google thanked “all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.” That’s a subtle but important shift — it means some of these bugs were caught internally or through partnerships before they could be exploited in the wild.
Still, 370 vulnerabilities in a single release is a lot. It raises the question: is Chrome getting more complex, or are researchers getting better at finding its weak spots? Probably both. As the browser adds features — GPU compute, WebGPU, advanced rendering — the attack surface grows. The good news is that Google’s bug bounty program is clearly working, and patches are being shipped fast.
Version 151 is rolling out now. Make sure you’re running it before you browse any further.
