Google has just reminded everyone how enormous Chrome’s attack surface can be, rolling out fixes for 370 security flaws in a single browser update.
Chrome version 151 arrives with patches affecting core browser technologies, several of which contain memory-safety bugs that can lead to browser crashes or arbitrary code execution.
Although Google has not reported active exploitation, vulnerabilities affecting these components typically receive close attention from security researchers because they sit deep inside the browser’s architecture.
The release also illustrates how browser security has shifted from reacting to attacks toward preventing them before they emerge. Many of the vulnerabilities were uncovered through Google’s internal testing and security research programs rather than through public incidents, allowing the company to close hundreds of weaknesses before they became broader security problems.
Use-after-free bugs dominate Chrome’s latest security update
Of the 370 vulnerabilities Google addressed in Chrome 151, seven were rated Critical, 71 High, 170 Medium, and 122 Low, according to Inforsecurity Magazine. The update spans nearly every layer of the browser, including Chrome’s update mechanism.
Among the fixes, use-after-free bugs appeared repeatedly. Google patched four Critical vulnerabilities affecting the Compositing, Views, Skia, and Ozone components, all stemming from a class of memory-safety flaws.
A use-after-free bug occurs when software continues to access memory after it has been freed, creating opportunities for memory corruption that, under certain conditions, could allow an attacker to crash the browser or execute arbitrary code.
The remaining Critical vulnerabilities involved insufficient validation of untrusted input in the Dawn and ANGLE components, as well as a race condition in Chrome’s updater.
The High, Medium, and Low severity fixes covered a broad range of browser subsystems, including Navigation, PDF, Downloads, Password Manager, Site Isolation, Audio, and Chrome Enterprise.
Many of these vulnerabilities fell into familiar categories such as type confusion, integer overflow, out-of-bounds memory access, and policy bypasses. These are bug classes that security researchers often examine because they can sometimes be chained together to bypass browser defenses.
Must-read security coverage
In its announcement, Chrome thanked security researchers who helped flag security flaws, preventing them from reaching production code.
Google said many Chrome security bugs are detected using automated tools, including AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL.
While these tools are not AI-powered, their growing use in software development and testing underscores their importance and points to the future of vulnerability testing. That same path has recently become actively favored by Microsoft, which recently discovered a record-breaking number of vulnerabilities on its last Patch Tuesday update using AI.
What can users do now?
For Chrome users, the most important task is to ensure their browser is up to date. Chrome usually downloads updates automatically, but users must relaunch the browser to apply them. Because browser vulnerabilities can be severe, it is still worth checking manually.
To do so, type chrome://version in your browser; if it shows 151.xxx, it is up to date. The update applies to Windows, macOS users, and Linux
The company also noted that it has withheld technical details about several vulnerabilities until most users have installed the update, to reduce the risk of attackers leveraging published exploits to attack users, as we’ve seen recently.
Read the full article here
