Chrome 151 Update Addresses 41 Security Flaws

Google released an update for Chrome on Thursday that resolves 41 critical- and high-severity vulnerabilities. The update is part of an ongoing Google’s use of AI to increase the velocity of its patching lifecycle.

Breakdown of Vulnerability Severity

• 6 vulnerabilities are classified as critical-severity.
• 35 vulnerabilities are classified as high-severity.
• 24 of the 35 high-severity issues are memory safety bugs.
• 2 bounty rewards of $500 were disclosed by Google for the high-severity findings.

Critical-Severity Flaw Details

The update addresses six critical-severity issues. These include five use-after-free vulnerabilities located in WebGL, Aura, Skia, and Views. Additionally, the release fixes an out-of-bounds write vulnerability identified in the ANGLE graphics engine.

Memory Safety and Other Defects

Beyond the critical flaws, the update resolves 35 high-severity issues. More than two dozen of the total defects reported are memory safety bugs, which can result in data corruption, application crashes, or arbitrary code execution. The remaining high-severity flaws include integer overflows, race conditions, insufficient validations of untrusted input, and inappropriate implementations.

Distribution and Discovery

Google discovered 25 of the 35 high-severity vulnerabilities internally. External researchers were credited for the other 10. Regarding the two WebGL security defects, Google credited external researchers for the discovery but has not yet determined the specific bug bounty rewards for those findings.

Deployment Across Desktop Platforms

The latest iteration of the browser is currently rolling out to users. For Windows and macOS, the software is updating to versions 151.0.7922.108/.109. For Linux users, the update is arriving as version 151.0.7922.108.

Security Recommendations for Users

Google has not reported any evidence that these vulnerabilities are being exploited in the wild. Despite the lack of confirmed active exploitation, users are advised to update their browsers as soon as possible to mitigate potential risks associated with the reported security defects.

Implications for Browser Security

The nature of these vulnerabilities, particularly those involving memory safety that could lead to arbitrary code execution, underscores the importance of keeping browser software current. While this specific update contains fewer fixes than some recent browser refreshes, the reliance on automated systems to identify and address these flaws indicates a shift in how software vendors manage the lifecycle of complex browser vulnerabilities.