Google has released Chrome 151 Stable, fixing seven security vulnerabilities, including a critical use-after-free flaw in Chromoting that could potentially allow remote code execution.
The most severe issue is tracked as CVE-2026-76017 and affects Chromoting, the technology used by Chrome Remote Desktop.
Use-after-free vulnerabilities occur when software continues to access memory after it has been released.
Chrome 151 Fixes Critical Chromoting FlawIn this case, the affected component is Chromoting, making the flaw especially significant in environments that use Chrome Remote Desktop.
The release further fixes CVE-2026-76021, another use-after-free vulnerability in the Document Object Model component.
Google has released Chrome 151 Stable, fixing seven security vulnerabilities, including a critical use-after-free flaw in Chromoting that could potentially allow remote code execution.
The update is rolling out as version 151.0.7922.173/.174 for Windows and macOS, and version 151.0.7922.173 for Linux. The most severe issue is tracked as CVE-2026-76017 and affects Chromoting, the technology used by Chrome Remote Desktop.
Google classified the vulnerability as critical and described it as a use-after-free bug. The issue was reported internally by Google on June 11, 2026. Use-after-free vulnerabilities occur when software continues to access memory after it has been released.
If an attacker can reliably control the reused memory area, they may be able to corrupt application behavior, crash the browser, disclose sensitive information, or execute attacker-controlled code.
Chrome 151 Fixes Critical Chromoting Flaw
In this case, the affected component is Chromoting, making the flaw especially significant in environments that use Chrome Remote Desktop.
Google has not released technical details, proof-of-concept code, exploitation prerequisites, or information about active exploitation. The company said bug information may remain restricted until most Chrome users have installed the security update.
This is a standard protection measure intended to reduce the likelihood of attackers weaponizing a vulnerability before organizations and individuals can patch affected systems. Chrome 151 also addresses six high-severity vulnerabilities across several browser components.
These include CVE-2026-76018, a privilege-escalation flaw in Import; CVE-2026-76019, an incorrect-authorization issue in Workers; and CVE-2026-76020, a race condition in the V8 JavaScript engine.
The release further fixes CVE-2026-76021, another use-after-free vulnerability in the Document Object Model component. DOM bugs can be security-relevant because web content interacts heavily with browser rendering and scripting functions.
Google also patched CVE-2026-76022, a buffer overflow in the Network component, and CVE-2026-76023, an improper resource control flaw in Linux Toolkit Theming.
CVE ID Severity Vulnerability Type Affected Component Reporter CVE-2026-76017 Critical Use-after-free Chromoting Google CVE-2026-76018 High Privilege elevation Import Google CVE-2026-76019 High Incorrect authorization Workers Anonymous CVE-2026-76020 High Race condition V8 Salvatore Gulizia (Serotav) CVE-2026-76021 High Use-after-free DOM Google BigSleep@Grape CVE-2026-76022 High Buffer overflow Network 0xAlessandro CVE-2026-76023 High Improper resource control Linux Toolkit Theming Keita Sode and Daisuke Hatakeyama, SYZD Research
The presence of multiple memory-safety issues in this release highlights the continued security importance of browser patch management. Chrome processes untrusted web content, JavaScript, images, downloads, and remote resources every day.
Vulnerabilities in browser components can therefore provide a route for attackers to compromise endpoint systems through malicious websites, advertisements, phishing links, or crafted web content. Organizations should prioritize updating Chrome on managed Windows, macOS, and Linux endpoints.
Administrators should verify browser version deployment via endpoint management platforms and ensure that systems restart Chrome when necessary, as users may continue running an older, vulnerable process until the browser is relaunched.
Users can manually check for the update by opening Chrome, navigating to Settings, selecting About Chrome, and allowing the browser to download the latest available release.
After installation, Chrome should be restarted to activate the fixes. Google credited security researchers and internal teams for identifying vulnerabilities during the development cycle.
The Chromium project also relies on security testing technologies such as AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL to identify flaws before they reach stable releases.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
