Google Chrome Update Fixes 382 Security Flaws, Including Critical UAF Vulnerabilities

Google has rolled out Chrome 151 to the stable channel for Windows, Mac, and Linux, patching a staggering 382 security vulnerabilities, among them multiple critical-severity use-after-free (UAF) bugs that could allow attackers to execute arbitrary code.

The update addresses at least 10 critical-rated use-after-free (UAF) vulnerabilities across core browser components, reflecting the persistent challenge that UAF bugs pose in memory-managed C++ codebases like Chromium.

Notable critical UAF issues include CVE-2026-13774 in Extensions, CVE-2026-13775 in GPU, CVE-2026-13778 in WebUSB, CVE-2026-13779 and CVE-2026-13787 in Chromoting, CVE-2026-13782 in Browser, CVE-2026-13783 and CVE-2026-13784 in Views, CVE-2026-13785 in Bluetooth, CVE-2026-13786 in Ozone, and CVE-2026-13788 in Fullscreen.

Use-after-free vulnerabilities occur when a program continues to reference memory after it has been freed, potentially letting attackers hijack the freed memory region to execute malicious code or crash the browser.

Chrome 151 Stable Update

Beyond UAF flaws, the critical bucket also includes CVE-2026-13776, a Type Confusion bug in Dawn, along with insufficient input validation issues tracked as CVE-2026-13777 in iOSWeb, CVE-2026-13780 in ANGLE, and CVE-2026-13781 in Skia.

Type confusion bugs arise when code treats an object as a different type than it actually is, which can be exploited similarly to memory corruption flaws to achieve remote code execution.

The High-severity tier makes up the bulk of the patch batch and includes several externally reported, well-rewarded bugs. A researcher earned a $36,000 bounty for CVE-2026-13789, a use-after-free in GPU, the largest single payout in this release.

Other significant High-severity findings include CVE-2026-13790, a side-channel information leakage flaw in Scroll, rewarded at $10,000, and CVE-2026-13791, an input validation weakness in Downloads, reported by Imperva researcher Ron Masas, also rewarded at $10,000.

Additional High-severity use-after-free bugs were found across the Touchbar, Views, Blink, Canvas, IME, Import, and Chromecast components, many of which were self-discovered internally by Google’s security team.

The remaining fixes are largely Medium-severity, addressing insufficient validation and policy enforcement issues in areas such as Passkeys/Security Keys (WebAuthn), WebHID, CustomTabs, Geolocation, and Enterprise policies.

Notable externally reported Medium bugs include CVE-2026-13856 in Speech ($8,000 bounty), CVE-2026-13857 in Geometry ($5,000), and CVE-2026-13858, an out-of-bounds read in FFmpeg discovered by researchers at Theori ($3,000).

With 382 fixes in a single release, an unusually large batch even by Chrome’s standards, the update underscores that memory-safety issues like use-after-free and type confusion continue to dominate research on browser exploitation.

Because Chrome’s engine (Blink/V8) and GPU stack (ANGLE, Dawn, Skia) are shared across Chromium-based browsers like Edge and Brave, downstream browsers will likely need corresponding patches soon.

Mitigation

According to the Google advisory, security teams and end users should prioritize immediate updates, given multiple critical UAF vulnerabilities that could enable remote code execution via a malicious webpage.

• Update Chrome to version 151 (150.0.7871.46/.47) via Settings > About Chrome, or allow auto-update to complete.
• Restart the browser after updating to ensure patches take effect.
• Enterprises managing Chromium-based fleets should verify update deployment through their endpoint management console given the volume and severity of fixes.
• Monitor for delayed disclosure, as Google restricts technical details on several bugs until a majority of users have patched.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.