Google has launched a brand new Chrome Steady Channel replace for desktop platforms, fixing 5 high-severity safety vulnerabilities that have an effect on core browser parts.
The issues embrace a number of use-after-free memory-safety points that, if efficiently exploited, might doubtlessly allow distant assaults by means of malicious internet content material.
The replace strikes Chrome to model 151.0.7922.137/.138 on Home windows and macOS, whereas Linux customers obtain model 151.0.7922.137.
Google Chrome Patches A number of Browser Flaws
All 5 safety points addressed within the launch carry a Excessive severity score. The vulnerabilities span Chrome’s JavaScript engine, interface parts, extension framework, HTML processing, and Blink rendering engine.
| CVE | Element | Vulnerability sort | Reporter |
|---|---|---|---|
| CVE-2026-19556 | V8 | Use-after-free | Jihyeon Jeong, Compsec Lab / Seoul Nationwide College |
| CVE-2026-19557 | TabStrip | Use-after-free | |
| CVE-2026-19558 | Extensions | Use-after-free | @bean5oup |
| CVE-2026-19559 | HTML | Use-after-free | |
| CVE-2026-19560 | Blink | Use-after-free | WinD39 / Huynh Dinh Vu |
CVE-2026-19556, affecting the V8 JavaScript and WebAssembly engine, was reported on July 15, 2026, and earned a $500 bug bounty. V8 flaws are significantly vital as a result of internet purposes routinely course of attacker-controlled JavaScript.
A menace actor might try to ship exploit code through a weaponized web site, a phishing hyperlink, a compromised commercial, or content material hosted on a respectable however breached area.
Use-after-free vulnerabilities come up when software program continues to entry a reminiscence location after that reminiscence has been freed.
An attacker who can reliably affect subsequent reminiscence allocation might manipulate program move, trigger browser crashes, leak delicate information, or execute code inside the affected course of.
Exploitability relies on a number of components, together with the browser’s sandboxing protections, reminiscence mitigations, goal working system, and whether or not a vulnerability may be mixed with one other flaw.
Google’s advisory doesn’t state that any of the 5 vulnerabilities have been exploited within the wild. Nevertheless, the presence of high-severity use-after-free points throughout V8, Blink, HTML, and Extensions makes speedy patching prudent.
Blink and HTML are central to Chrome’s dealing with of internet pages, whereas the Extensions part presents a definite enterprise concern. Organizations that permit third-party Chrome extensions ought to overview their extension governance and reduce pointless browser add-ons to scale back the assault floor accessible to customers.
Replace and Mitigation
Directors ought to confirm that managed Home windows and macOS endpoints attain Chrome 151.0.7922.137/.138, whereas Linux fleets ought to be up to date to 151.0.7922.137 or later.
Particular person customers can test their put in launch by means of the Chrome menu → Assist → About Google Chrome, which triggers an replace test and requires a browser relaunch to finish set up.
Google noted that technical particulars and bug-tracker hyperlinks might stay restricted till most customers have obtained the fixes. This disclosure strategy is meant to scale back the window through which attackers can reverse-engineer patches and goal unpatched programs.
Safety groups ought to prioritize monitoring browser variations, implement automated updates through enterprise administration instruments, and alert on endpoints operating outdated Chrome builds.
Detect, examine, and reply quicker with in-browser information inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
