- On July 29, 2026, Google updated the Chrome browser to versions 151.0.7922.71/.72.
- The update fixes 370 vulnerabilities, including seven critical ones.
- The critical vulnerabilities include issues such as use-after-free in Compositing, Views, Skia, and Ozone, which can be exploited for arbitrary code execution.
- Other critical flaws involve race conditions in the Updater and insufficient validation of untrusted input in graphics libraries like Dawn and ANGLE.
- The vulnerabilities increase the potential for sandbox escapes, privilege escalation, or data corruption when an attacker triggers specific states in the browser.
- In addition to the critical vulnerabilities, there are numerous high-severity issues across various components including V8, Navigation, and WebGL.
Google's Chrome 151 for Android, released on July 29, 2026, addresses 370 security vulnerabilities, including seven critical flaws that could lead to arbitrary code execution. The update is available for Windows, macOS, and Linux, enhancing browser security significantly.1
According to Google’s security advisory, this release includes vulnerabilities in core browser components, graphics, networking, and platform-specific features. The critical vulnerabilities are assigned CVE-2026-17650 through CVE-2026-17656, with issues found in components such as Compositing, Views, Skia, and Ozone.4
Specific critical flaws include:
CVE-2026-17650: Use-after-free in Compositing.
CVE-2026-17651: Insufficient validation of untrusted input in Dawn.
CVE-2026-17652: Use-after-free in Views.
CVE-2026-17653: Use-after-free in Skia.
CVE-2026-17654: Race condition in Updater.
CVE-2026-17655: Insufficient validation of untrusted input in ANGLE.
CVE-2026-17656: Use-after-free in Ozone.
These vulnerabilities increase the potential for sandbox escapes, privilege escalation, or data corruption when an attacker can trigger specific states in the browser via update processes. In addition to the critical vulnerabilities, numerous high-severity issues across V8, Navigation, QUIC, Audio, Media, WebGL, and Downloads were also addressed. Many of these issues involve use-after-free errors, out-of-bounds reads/writes, integer overflows, and type confusion scenarios that can enable remote code execution or compromise the browser’s integrity.67
Google credits both its internal teams and external security researchers, noting that many security flaws are identified during development before reaching the Stable channel.
“The update resolves critical vulnerabilities assigned CVE-2026-17650 through CVE-2026-17656, which could lead to arbitrary code execution. Google credits both internal teams and external researchers for identifying many of these security flaws during development before they reached the Stable channel.”
BornCity
CyberSecurityNews
