Google Patches 151 Vulnerabilities in Chrome, Including 22 Critical Ones
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Google has pushed a major Chrome Stable update<\/a> that fixes 151 security flaws, including 22 critical vulnerabilities affecting core graphics, networking, media, and UI components across Windows, macOS, and Linux.<\/p>\n The Stable channel has been updated to version 148.0.7778.216\/217 for Windows, 148.0.7778.215\/216 for macOS, and 148.0.7778.215 for Linux, with the rollout scheduled over the coming days and weeks.<\/p>\n A full list of code changes between builds 148.0.7778.180 and 148.0.7778.217 is available in the Chromium source log. However, Google is restricting detailed bug information until most users receive the patch.<\/p>\n This staggered disclosure reduces the risk that attackers will weaponize the bugs against unpatched systems.<\/p>\n Google credits both internal teams and external security researchers for surfacing the issues during the development cycle and notes that many bugs were caught before they ever reached the stable branch.<\/p>\n The company again highlights its use of sanitizers, fuzzers, and control-flow integrity to detect memory corruption and undefined behavior at scale.<\/p>\n Of the 151 vulnerabilities, 22 are rated critical, and several have already attracted substantial bug bounties.<\/p>\n Notable externally reported issues include an out-of-bounds write in the GPU process (CVE-2026-9872), use-after-free in Network (CVE-2026-9873), a use-after-free in Dawn (CVE-2026-9874), and an out-of-bounds read in WebGL (CVE-2026-9875), with rewards of up to 43,000 USD per report.<\/p>\n These flaws could enable sandbox escapes, remote code execution, or data corruption if an attacker can lure a victim to a malicious page.<\/p>\n The majority of critical fixes, however, come from Google\u2019s own teams and target the graphics and rendering stack<\/a>, including ANGLE, Skia, WebGL, Dawn, XR, Bluetooth, UI, and core browser infrastructure.<\/p>\n Issues range from use\u2011after\u2011free and heap buffer overflows to integer overflows and insufficient validation of untrusted input, all of which are classic building blocks for reliable exploits in modern browsers.<\/p>\n Beyond the critical bugs, Google patched <\/a>a large set of high\u2011severity flaws across DOM, Accessibility, Site Isolation, WebCodecs, PDF\/PDFium, WebRTC, Passwords, WebAppInstalls, Media, USB, and more.<\/p>\n These include additional use\u2011after\u2011free conditions, out\u2011of\u2011bounds reads and writes<\/a>, race conditions, and uninitialized memory use, many of which were reported internally. However, some also credited researchers at Mozilla, Microsoft, OpenAI, and others.<\/p>\n151 Vulnerabilities Patched in Chrome<\/strong><\/h2>\n