Chrome 151 Update Patches 41 Critical, High-Severity Flaws

Google Chrome 151 Update Patches 41 Critical, High-Severity Flaws

Google has released Chrome 151, a significant update addressing a total of 41 security vulnerabilities classified by the vendor as critical and high-severity. This update is crucial for all Chrome users, as many of these defects are memory safety bugs that could potentially lead to severe consequences, including data corruption, browser crashes, and even arbitrary code execution. Security professionals should prioritize applying this update across their environments, as stated in the SecurityWeek report.

Technical Analysis: Google Chrome 151 Vulnerabilities and Memory Safety Bugs

The Chrome 151 update (versions 151.0.7922.108/.109 for Windows and macOS, and 151.0.7922.108 for Linux) resolves six critical-severity flaws. Among these, five are use-after-free issues found in various browser components, specifically WebGL, Aura, Skia, and Views. Use-after-free vulnerabilities occur when an application attempts to use memory after it has been freed, which can lead to unpredictable behavior, including arbitrary code execution if an attacker can manipulate the freed memory. The sixth critical flaw is an out-of-bounds write in the ANGLE graphics engine, another class of memory corruption vulnerability that can also enable arbitrary code execution.

Google credited external researchers for discovering two of the WebGL security defects, while Google’s internal teams found the remaining four critical weaknesses. The company has not yet disclosed all bug bounty rewards for these findings.

Beyond the critical issues, the update also resolves 35 high-severity vulnerabilities. A substantial portion of these, 24 to be exact, are memory safety bugs. This category encompasses a range of dangerous flaws such as use-after-free, buffer overflow, out-of-bounds write, and uninitialized use defects. These types of vulnerabilities consistently rank among the most critical threats due to their potential for remote code execution and system compromise. The remaining high-severity flaws include insufficient validations of untrusted input, inappropriate implementations, race conditions, and integer overflows. Google discovered 25 of these high-severity issues internally, with external researchers credited for 10. Rewards of $500 were disclosed for two of these findings.

While Google has not indicated any active exploitation of these specific vulnerabilities in the wild, the inherent severity of memory corruption issues, particularly in a widely used web browser, mandates immediate attention. Defenders searching for how to patch Google Chrome 151 vulnerabilities should be aware that these updates are essential for maintaining endpoint security.

Actionable Recommendations and Mitigations

Given the severity and breadth of the patched vulnerabilities, security teams and individual users must take prompt action.

• Immediate Update: The most critical step is to update Google Chrome immediately.
  • For Windows and macOS users, update to version 151.0.7922.108 or 151.0.7922.109.
  • For Linux users, update to version 151.0.7922.108. Users can typically update Chrome by navigating to Settings > About Chrome (or Help > About Google Chrome). The browser will automatically check for and apply updates.
• Automated Patch Management: Organizations should ensure their patch management systems are configured to automatically deploy browser updates for Google Chrome across all endpoints. This helps in mitigating the risks associated with newly disclosed vulnerabilities swiftly.
• User Awareness: Educate users on the importance of keeping their browsers updated. Browser security is a shared responsibility, and prompt updates are a primary defense against client-side exploitation.
• Security Configuration Review: Periodically review Chrome’s security and privacy settings, enabling features like Enhanced Safe Browsing to provide additional layers of protection against web-based threats.
• Endpoint Detection and Response (EDR): Implement EDR solutions to monitor for suspicious activity, even after patching. While updates close known vulnerability gaps, persistent threats may leverage other vectors. Monitoring for anomalous process behavior or unusual network connections can help detect potential post-exploitation attempts.

Understanding mitigation steps for Chrome memory safety bugs extends beyond patching. While the update fixes these specific instances, general best practices for secure browsing and endpoint protection remain vital for a comprehensive security posture. This update reinforces Google’s ongoing commitment to browser security, partly driven by accelerated patching processes, potentially enhanced by AI-driven analysis.

Related: Chrome 150 Update: Patching 27 Vulnerabilities, Critical Use-After-Free Flaws, Chrome 148 Update: Patching Critical Use-After-Free Vulnerabilities