"We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel," Google said in its update.
Google release and affected versions
On July 29, Google’s Chrome security team published an update to Chrome 151 that patches a total of 370 vulnerabilities across Windows, Mac and Linux builds. The Mac binaries are identified as 151.0.7922.71 and 151.0.7922.72; Windows and Linux updates are listed as 151.0.7922.71 for Linux and the equivalent 151 family for Windows. The release consolidates fixes discovered and reported to Google between May 18 and June 14, 2026.
The seven critical vulnerabilities and where they occur
The update addresses seven vulnerabilities Google classed as critical. Four are “use after free” bugs affecting distinct components: Compositing (CVE-2026-17650, reported May 18, 2026), Views (CVE-2026-17652, reported June 2, 2026), Skia (CVE-2026-17653, reported June 5, 2026) and Ozone (CVE-2026-17656, reported June 14, 2026). Two critical flaws involve insufficient validation of untrusted input: one in Dawn (CVE-2026-17651, reported May 28, 2026) and one in ANGLE (CVE-2026-17655, reported June 11, 2026). A final critical issue is a race condition in the Updater component (CVE-2026-17654, reported June 10, 2026).
ANGLE is described in Google’s advisory as “an open-source tool that translates OpenGL ES graphics code into other formats like Vulkan, DirectX or Metal to help programs and web browsers run 3D graphics smoothly on different computers and phones without needing special drivers.”
Severity breakdown: beyond the criticals
Beyond the seven critical items, Chrome 151 includes fixes for 71 high-severity, 170 medium-severity and 122 low-severity security issues, bringing the total to 370 patched vulnerabilities in this release. Those figures reflect Google’s internal classification across the browser and related components rather than a single component’s tally.
Bug bounty payouts and outstanding disclosure
Google reported that security researchers received a combined $58,500 through its bug bounty program for uncovering the flaws fixed in this release. The company also noted that payout specifics for 13 of the bugs have not yet been made public. In its announcement Google thanked the researchers "that worked with us during the development cycle" to prevent these bugs from reaching the stable channel.
What this means for technologists, enterprises, and end users
- Technologists and security teams: The seven critical CVEs — CVE-2026-17650 through CVE-2026-17656 — will be primary triage targets because they involve memory-safety bugs (“use after free”), input-validation issues, and an Updater race condition reported between May 18 and June 14, 2026. Teams tracking component-specific risk should note the affected modules: Compositing, Views, Skia, Ozone, Dawn, ANGLE and Updater.
- Enterprises and procurement leaders: The update’s explicit build numbers for Mac (151.0.7922.71/.72) and Linux (151.0.7922.71) provide concrete markers for inventory and patch verification. The broader tally of 71 high, 170 medium and 122 low severity fixes should inform patch windows and testing priorities.
- End users: The release consolidates hundreds of fixes into Chrome 151; the advisory lists the release date as July 29 and the specific Mac and Linux build numbers, which users and administrators can use to confirm whether their installations reflect the patched versions.
The Chrome 151 release is notable both for the concentration of memory-safety and input-validation fixes among the critical items and for the scale of the update: 370 vulnerabilities patched at once and $58,500 awarded to researchers. Thirteen undisclosed bounty details remain outstanding, and the seven critical CVEs — each tied to named components and reporting dates — provide a clear checklist for defenders verifying patch status across platforms.
Original report: https://www.infosecurity-magazine.com/news/google-patches-370-vulnerabilities/
