Chrome 151 Patches 370 Flaws, Including an Exploited V8 Zero-Day

Google pushed Chrome 151 to the stable channel on July 29. The update carries 370 security fixes, seven rated Critical. More pressingly: one of the vulnerabilities it patches — a V8 out-of-bounds flaw designated CVE-2026-11645 — was already on the CISA Known Exploited Vulnerabilities list before this release shipped. Active exploitation in the wild. Update now.

One Flaw Was Already Being Exploited

CVE-2026-11645 is an out-of-bounds read and write vulnerability in V8, Chrome’s JavaScript engine. CVSS score: 8.8. An attacker can trigger arbitrary code execution inside the browser sandbox just by serving a crafted HTML page — no additional user interaction required beyond visiting the site.

CISA added it to the KEV catalog on June 9, 2026. That means federal agencies had a hard deadline to patch. If you’re still running Chrome 150 or earlier on any machine or CI runner, you’re exposed to a confirmed, actively exploited flaw.

Seven New Critical CVEs in This Release

Beyond the KEV entry, Chrome 151 patches seven freshly discovered Critical vulnerabilities (CVE-2026-17650 through CVE-2026-17656). Google’s own security team found all seven — no external researchers involved. That’s a direct result of the AI pipeline described below.

The breakdown by component:

• Compositing, Views, Skia, Ozone — four use-after-free bugs. A compromised renderer process can escalate to a sandbox escape via memory corruption triggered by crafted web content.
• Dawn and ANGLE — two insufficient-validation flaws in Chrome’s GPU abstraction layers. Invalid graphics input can reach GPU driver code paths, making these especially dangerous in GPU-accelerated workloads.
• Updater — a race condition in the update mechanism. Worth noting for enterprise environments with managed update flows or deferred patching policies.

No confirmed in-the-wild exploitation for these seven yet. That window is typically 48–72 hours after a high-profile disclosure. The clock is ticking.

Why 370 Patches in One Release

If 370 fixes in a single Chrome release sounds alarming, here’s the context. In 2026, Google deployed a Gemini-powered agent harness that scans Chrome’s full codebase on every commit. It runs three agent types in sequence: fixing agents draft candidate patches, critic agents review them against Chromium standards, and test-writing agents generate cross-platform test suites.

The result: Chrome 149, 150, and 151 combined patched 1,442 security flaws — more than the prior 23 stable releases combined. One of those AI-discovered bugs was a critical sandbox escape (CVE-2026-3545, CVSS 9.6) hiding in the Navigation component for 13 years.

Chrome didn’t suddenly get less secure. The detection capability went up dramatically. Expect similar patch volumes going forward — this is the new normal for browser security.

What Developers Need to Do

If you run Chrome in CI — for Playwright, Selenium, or any headless browser testing — this update requires action beyond your workstation.

Verify your version:

google-chrome --version
# Must show: Google Chrome 151.0.7922.71 or later

CI and Docker environments:

• Rebuild Docker runner images that bundle google-chrome-stable: run apt-get update && apt-get install -y google-chrome-stable
• Playwright: sync your mcr.microsoft.com/playwright image tag to your @playwright/test package version — a mismatch breaks headless runs silently
• Selenium: update ChromeDriver to the matching Chrome 151 version
• macOS 12 Monterey CI runners: Chrome 151 is the last update these machines receive. Move those runners to macOS 13 or later.

Two Breaking Changes

Chrome 151 ships two changes that can break existing code:

1. macOS 12 Monterey support ends. Macs on macOS 12 still load Chrome 151, but no future security updates will arrive. For CI, macOS 12 runners are now a security liability, not just a version management footnote.
2. FontFaceSet constructor now throws. Calling new FontFaceSet() now raises TypeError: Illegal constructor, aligning Chrome with the CSS Font Loading spec. If you have custom font loading code that instantiates FontFaceSet directly, it breaks in Chrome 151. Switch to document.fonts.

The full list of deprecations and API changes is in the Chrome 151 release notes for developers.

Bottom Line

Chrome 151 has one actively exploited CVE already patched, seven new Critical flaws now patched, and no grace period on any of them. The stable channel update is live. Get it on every workstation, rebuild your CI images, move macOS 12 runners, and audit any code calling new FontFaceSet(). The official Chrome release announcement has full version numbers and rollout details.