Chrome 150 fixes 27 security flaws, including two critical bugs

Google released Chrome 150 on Wednesday to patch 27 security vulnerabilities. The update addresses two critical use-after-free bugs in Chrome’s Ozone and Views components and fixes 13 use-after-free defects in total.

The release is available as version 150.0.7871.114/.115 for Windows and macOS, and 150.0.7871.114 for Linux. Google’s advisory states the fixes close a range of memory-safety and logic flaws discovered last month and earlier.

In addition to use-after-free defects, the update patches problems classified as uninitialized use, integer overflow, out-of-bounds read and write, insufficient validation of untrusted input, inappropriate implementation, insufficient data validation and insufficient policy enforcement.

Of the 13 use-after-free defects, 10 were rated high severity and one was rated medium severity. The patched flaws affect both memory handling and input validation across the browser’s codebase.

Most of the vulnerabilities were found by Google’s internal teams. Three defects were reported by external researchers, who received a combined $3,000 in bug bounty payments. Google attributed the higher volume of internally found flaws and the lower external rewards in part to increased use of automated techniques, including AI, in vulnerability discovery.

Since April, Google has issued fixes for more than 1,400 Chrome vulnerabilities, including hundreds of memory-safety bugs. Chrome updates released in June and July resolved over 1,000 defects.

Users and administrators are advised to install the update promptly. Use-after-free bugs occur when software keeps referencing memory after it has been freed; that can cause crashes or allow an attacker to execute code if they can control memory contents.

The other fixes affect how Chrome handles input and enforces policies and can create security gaps if left unpatched. Administrators should verify update tools and deploy the new versions to affected systems.