Google Addresses 370 Security Vulnerabilities in Chrome Update
On July 29, Google’s Chrome security team unveiled a significant update addressing a total of 370 vulnerabilities found within its widely used web browser. Among these vulnerabilities, seven have been categorized as critical, underscoring the urgency and seriousness of the threats they pose.
This extensive patch was released as part of Chrome version 151, which is applicable across platforms, including Windows, Mac, and Linux. The specific versions now labeled as secure are 151.0.7922.71 and 151.0.7922.72 for Mac operating systems and 151.0.7922.71 for Linux users.
Among the seven critical vulnerabilities addressed, several relate to the ‘use after free’ memory management error, which can lead to arbitrary code execution. These issues were identified in critical components such as Compositing, Views, Skia, and Ozone. The ‘use after free’ flaw occurs when a program continues to process memory after it has been freed, allowing malicious entities to exploit this oversight.
Additionally, the update tackles vulnerabilities associated with insufficient validation of untrusted inputs in components like Dawn and the Almost Native Graphics Layer Engine (ANGLE). The latter is an essential open-source tool that enables the conversion of OpenGL ES graphics code into more widely accepted formats, such as Vulkan, DirectX, and Metal. This process enhances the smooth functionality of 3D graphics across various computing devices and mobile platforms. Furthermore, a notable race condition in the Updater also falls within the scope of these critical vulnerabilities.
The issues were documented and reported by Google’s security team between May 18 and June 14 of 2026, highlighting a focused effort to bolster browser security. The specific critical vulnerabilities reported are identified by their Common Vulnerabilities and Exposures (CVE) numbers. The list includes:
- CVE-2026-17650: Use after free in Compositing, reported on May 18, 2026.
- CVE-2026-17651: Insufficient validation of untrusted input in Dawn, reported on May 28, 2026.
- CVE-2026-17652: Use after free in Views, reported on June 2, 2026.
- CVE-2026-17653: Use after free in Skia, reported on June 5, 2026.
- CVE-2026-17654: Race condition in Updater, reported on June 10, 2026.
- CVE-2026-17655: Insufficient validation of untrusted input in ANGLE, reported on June 11, 2026.
- CVE-2026-17656: Use after free in Ozone, reported on June 14, 2026.
Beyond these critical issues, the latest Chrome update also encompasses fixes for other vulnerabilities, classified as follows: 71 high-severity, 170 medium-severity, and 122 low-severity problems. This comprehensive approach reinforces Google’s commitment to maintaining user security and providing frequent updates to address emerging threats.
As part of its bug bounty program, Google has incentivized security researchers to identify vulnerabilities, resulting in a cumulative payout of approximately $58,500. This figure reflects the collective reward for uncovering the identified flaws; however, it is worth noting that specifics regarding payouts for 13 of these bugs remain undisclosed.
In their communication accompanying the update, Google expressed gratitude towards the security researchers who collaborated with them during the development cycle, emphasizing the importance of their contributions in preventing such security flaws from impacting the stable release of Chrome. Their efforts have been invaluable in enhancing the security measures that protect billions of users worldwide.
This latest update serves as a reminder about the ongoing challenges of software security and the necessity of vigilance from both users and developers. With the ever-evolving landscape of cyber threats, maintaining up-to-date software remains a crucial aspect of safeguarding personal information and ensuring a secure browsing experience.
In conclusion, Google’s proactive measures highlight the importance of continuous improvement in software security, engaging with researchers to uncover potential vulnerabilities, and ensuring users can navigate the web with confidence. The tech giant’s experience serves as a crucial benchmark in the field of cybersecurity, illustrating the relentless pursuit of safety in digital spaces.
