Google has launched Chrome 151 Secure, fixing seven safety vulnerabilities, together with a important use-after-free flaw in Chromoting that might probably permit distant code execution.
The replace is rolling out as model 151.0.7922.173/.174 for Home windows and macOS, and model 151.0.7922.173 for Linux. Probably the most extreme challenge is tracked as CVE-2026-76017 and impacts Chromoting, the know-how utilized by Chrome Distant Desktop.
Google categorized the vulnerability as important and described it as a use-after-free bug. The difficulty was reported internally by Google on June 11, 2026. Use-after-free vulnerabilities happen when software program continues to entry reminiscence after it has been launched.
If an attacker can reliably management the reused reminiscence space, they can corrupt utility habits, crash the browser, disclose delicate data, or execute attacker-controlled code.
Chrome 151 Fixes Important Chromoting Flaw
On this case, the affected element is Chromoting, making the flaw particularly vital in environments that use Chrome Distant Desktop.
Google has not launched technical particulars, proof-of-concept code, exploitation conditions, or details about lively exploitation. The corporate mentioned bug data could stay restricted till most Chrome customers have put in the safety replace.
This can be a commonplace safety measure meant to scale back the chance of attackers weaponizing a vulnerability earlier than organizations and people can patch affected techniques. Chrome 151 additionally addresses six high-severity vulnerabilities throughout a number of browser parts.
These embrace CVE-2026-76018, a privilege-escalation flaw in Import; CVE-2026-76019, an incorrect-authorization challenge in Employees; and CVE-2026-76020, a race situation within the V8 JavaScript engine.
The discharge additional fixes CVE-2026-76021, one other use-after-free vulnerability within the Doc Object Mannequin element. DOM bugs may be security-relevant as a result of net content material interacts closely with browser rendering and scripting capabilities.
Google additionally patched CVE-2026-76022, a buffer overflow within the Community element, and CVE-2026-76023, an improper useful resource management flaw in Linux Toolkit Theming.
| CVE ID | Severity | Vulnerability Kind | Affected Part | Reporter |
|---|---|---|---|---|
| CVE-2026-76017 | Important | Use-after-free | Chromoting | |
| CVE-2026-76018 | Excessive | Privilege elevation | Import | |
| CVE-2026-76019 | Excessive | Incorrect authorization | Employees | Nameless |
| CVE-2026-76020 | Excessive | Race situation | V8 | Salvatore Gulizia (Serotav) |
| CVE-2026-76021 | Excessive | Use-after-free | DOM | Google BigSleep@Grape |
| CVE-2026-76022 | Excessive | Buffer overflow | Community | 0xAlessandro |
| CVE-2026-76023 | Excessive | Improper useful resource management | Linux Toolkit Theming | Keita Sode and Daisuke Hatakeyama, SYZD Analysis |
The presence of a number of memory-safety points in this release highlights the continued safety significance of browser patch administration. Chrome processes untrusted net content material, JavaScript, photos, downloads, and distant assets daily.
Vulnerabilities in browser parts can due to this fact present a route for attackers to compromise endpoint techniques via malicious web sites, commercials, phishing links, or crafted net content material. Organizations ought to prioritize updating Chrome on managed Home windows, macOS, and Linux endpoints.
Directors ought to confirm browser model deployment by way of endpoint administration platforms and be certain that techniques restart Chrome when vital, as customers could proceed working an older, weak course of till the browser is relaunched.
Customers can manually test for the replace by opening Chrome, navigating to Settings, choosing About Chrome, and permitting the browser to obtain the most recent accessible launch.
After set up, Chrome ought to be restarted to activate the fixes. Google credited safety researchers and inner groups for figuring out vulnerabilities in the course of the growth cycle.
The Chromium challenge additionally depends on safety testing applied sciences reminiscent of AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Management Circulate Integrity, libFuzzer, and AFL to establish flaws earlier than they attain steady releases.
Stop incidents as a result of sluggish investigations. Energy your Tier 1 with risk intelligence from 15K SOCs: Integrate TI Lookup in your SOC
