Google Chrome 115 Patches Five High-Severity Use-After-Free Flaws

Key Takeaways

• Google has released Chrome 151 to address five high-severity use-after-free vulnerabilities.
• The flaws impact critical components including the V8 JavaScript engine, Blink rendering engine, and Chrome Extensions.
• Successful exploitation could lead to browser crashes, information disclosure, or arbitrary code execution.
• The update, version 151.0.7922.137/.138 for Windows/macOS and 151.0.7922.137 for Linux, is rolling out now.
• Users are strongly advised to update their browsers immediately to mitigate these risks.

Chrome 151 Addresses Five High-Severity Memory Safety Flaws

Google has pushed Chrome 151 to its Stable channel, delivering crucial security updates that resolve five high-severity vulnerabilities. These flaws, all categorized as use-after-free (UAF) issues, affect core components of the popular web browser, including the V8 JavaScript engine, the Blink rendering engine, the Chrome Extensions framework, the HTML processing layer, and the TabStrip interface.

The update is currently being deployed as version 151.0.7922.137/.138 for Windows and macOS users, while Linux systems are receiving version 151.0.7922.137. Google anticipates a global rollout to all users over the coming days and weeks, urging prompt application of the patch.

Understanding Use-After-Free Vulnerabilities

All five vulnerabilities patched in Chrome 151 stem from the use-after-free (UAF) memory safety class. This class of bug arises when a program attempts to access memory that has already been deallocated, leading to unpredictable behavior. In the context of web browsers, malicious actors can exploit these vulnerabilities by crafting specific web scripts, HTML elements, or interactions with browser extensions.

The potential consequences of successful exploitation vary based on the affected subsystem and the exploit environment. Outcomes can range from browser crashes and the disclosure of sensitive information to the execution of arbitrary code on the affected system. This makes timely patching critical for both individual users and enterprise environments.

Details of the Patched Vulnerabilities

The following table outlines the specific CVE identifiers, affected subsystems, severity, and reporting details for the vulnerabilities addressed in Chrome 151:

Among the resolved issues, CVE-2026-19556 stands out as a high-severity UAF flaw impacting V8, Google Chrome’s open-source JavaScript and WebAssembly engine. This vulnerability was identified by Jihyeon Jeong, a research intern at Compsec Lab, Seoul National University, who received a $500 bug bounty for the discovery. Given that the V8 engine is responsible for processing web-supplied JavaScript code, vulnerabilities within it are frequently targeted by browser exploits.

As detailed in the official announcement on the Google Chrome Releases Blog, the update also includes fixes for CVE-2026-19560, a UAF flaw in the Blink rendering engine reported by Huynh Dinh Vu (WinD39), and CVE-2026-19558, affecting the Chrome Extensions API, reported by @bean5oup. Both the Extensions API and rendering engines possess extensive permissions to interact with web content, making memory safety in these components paramount to preventing remote code execution (RCE) vulnerabilities from impacting production systems.

Further highlighting the pervasive nature of memory safety risks, two additional vulnerabilities, CVE-2026-19557 in the TabStrip user interface and CVE-2026-19559 in the HTML parsing component, were discovered internally by Google. These findings underscore that critical memory safety issues can affect both front-end user experience elements and fundamental web content parsers.

In line with established security protocols, Google has temporarily withheld detailed technical specifics and public proof-of-concept (PoC) information for all five vulnerabilities. This measure is intended to allow a significant portion of the user base to update to Chrome 151, thereby minimizing the window of opportunity for threat actors to weaponize patch information against unpatched systems.

Google acknowledged the contributions of its security researchers and emphasized its ongoing commitment to automated fuzzing and defensive memory testing technologies throughout the development process.

What You Should Do

• Desktop Users: Update your Chrome browser immediately. Navigate to Help > About Google Chrome to trigger the automatic download of version 151.0.7922.137/.138 and restart the browser to complete the installation.
• Enterprise Administrators: Ensure that all managed Windows, macOS, and Linux endpoints receive the Chrome 151 update through your standard software deployment and patch management platforms. Verify successful deployment across your infrastructure.
• Stay Vigilant: Always keep your browser and operating system updated to the latest versions to protect against known vulnerabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.