Google Chrome 151 Patches Five High-Severity Use-After-Free Flaws in V8, Blink, and Extensions

Google has officially released Chrome 151 to the Stable channel, mitigating five high-severity security vulnerabilities impacting key browser engine components, including the V8 JavaScript engine, Blink rendering engine, Chrome Extensions framework, HTML processing layer, and TabStrip.

The update is currently rolling out as version 151.0.7922.137/.138 for Windows and macOS, while Linux systems receive version 151.0.7922.137. Google noted that the update will reach all users worldwide over the coming days and weeks.

Chrome 151 Patches Five High-Severity Flaws

All five vulnerabilities addressed in Chrome 151 belong to the use-after-free (UAF) memory safety class, which occurs when software continues to access memory after it has been deallocated.

In web browsers, adversaries can attempt to trigger these vulnerabilities using maliciously crafted web scripts, HTML elements, or extension interactions.

Depending on the targeted subsystem and exploit environment, successful exploitation can result in browser crashes, sensitive information disclosure, or arbitrary code execution.

Security teams tracking ongoing chrome security updates should prioritize applying desktop browser updates across enterprise endpoints.

CVE Identifier Affected Subsystem Severity Reported By & Date CVE-2026-19556 V8 JavaScript Engine High Jihyeon Jeong (Compsec Lab, SNU) — July 15, 2026 CVE-2026-19557 TabStrip Interface High Google Internal Discovery — July 14, 2026 CVE-2026-19558 Chrome Extensions High @bean5oup — July 20, 2026 CVE-2026-19559 HTML Processing High Google Internal Discovery — July 28, 2026 CVE-2026-19560 Blink Rendering Engine High WinD39 (Huynh Dinh Vu) — July 30, 2026

The most notable vulnerability resolved in this cycle is CVE-2026-19556, a high-severity UAF flaw in V8, Chrome’s open-source JavaScript and WebAssembly engine.

Discovered by research intern Jihyeon Jeong of Compsec Lab at Seoul National University, Google awarded a $500 bug bounty for the finding. Because V8 processes web-supplied JavaScript code, flaws in the V8 engine remain a primary target for browser exploits.

As highlighted in the official release post on the Google Chrome Releases Blog, the update also fixes CVE-2026-19560 in the Blink rendering engine (reported by Huynh Dinh Vu / WinD39) and CVE-2026-19558 in the Chrome Extensions API (reported by @bean5oup).

Extension APIs and rendering engines hold broad permissions to interact with web content, making memory safety in these layers critical for preventing Chrome RCE vulnerabilities from reaching production systems.

Two additional internal findings, CVE-2026-19557 in the TabStrip UI and CVE-2026-19559 in HTML parsing, demonstrate that memory safety risks span both front-end user interface components and core web parsers.

In line with standard security protocol, Google has restricted technical details and public proof-of-concept (PoC) information for all five bugs.

Details remain restricted until a majority of the active user base updates to Chrome 151, minimizing the risk of threat actors weaponizing patch information against unpatched endpoints.

Google credited its security researchers and highlighted its reliance on automated fuzzing and defensive memory testing technologies during development.

Desktop Users: Navigate to Help > About Google Chrome to trigger the automatic download of version 151.0.7922.137/.138 and restart the browser.

Enterprise Administrators: Verify that managed Windows, macOS, and Linux endpoints receive Chrome 151 through software deployment and patch management platforms.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model -> Register Now