Chrome 151 patches 370 flaws, including seven critical bugs

Google released Chrome 151 to the stable channel on Wednesday, delivering patches for 370 vulnerabilities, including seven rated critical. The update addresses memory, input-validation and race-condition flaws across Chrome’s rendering, graphics and update components.

The seven critical issues include four use-after-free vulnerabilities in Compositing, Views, Skia and Ozone; two insufficient-validation-of-untrusted-input flaws in Dawn and ANGLE; and a critical race condition in the Updater. In total, 71 defects in this release were rated high severity.

Additional high-severity fixes include use-after-free bugs affecting Navigation, V8, Loader, Views, Autofill, Input, DataTransfer, DOM, ANGLE, Audio, Updater and Media. Other high-level patches address inappropriate implementation, insufficient policy enforcement, uninitialized use, integer overflow, out-of-bounds reads and writes, type confusion, policy bypasses, race conditions, object lifecycle issues and a cryptographic flaw.

Chrome 151 also resolves 170 medium-severity weaknesses and 122 low-severity issues. Google reports that 30 of the fixed vulnerabilities affect ANGLE, the open-source WebGL backend Chrome uses for graphics rendering.

Google reported it discovered 349 of the issues and credited external researchers with reporting 21 vulnerabilities. The company has paid $58,500 in bug bounty rewards so far and has not disclosed payout amounts for 13 reported flaws. Since the start of the year, Google says it has resolved more than 1,800 vulnerabilities in Chrome.

The update is rolling out as Chrome version 151.0.7922.71/.72 for Windows and macOS and as version 151.0.7922.71 for Linux. Users and administrators are advised to apply the update through the browser’s normal update channels to ensure systems receive the security fixes.