Chrome 151 patches 370 vulns; CVE-2026-11645 V8 zero-day exploited in the wild

Google shipped Chrome 151 Stable, patching 370 vulns (7 Critical, 71 High, 170 Medium, 122 Low). CVE-2026-11645 (V8 OOB read/write, CVSS 8.8) is in CISA KEV and exploited in the wild. Seven new Criticals (CVE-2026-17650–17656) hit Compositing, Views, Skia, Ozone, Dawn, ANGLE, and Updater via UAF and input-validation flaws.

Incident overview

On 2026-07-29 Google pushed Chrome 151 to Stable: Windows/macOS 151.0.7922.71/.72, Linux 151.0.7922.71. The release patches 370 security vulnerabilities—one of the largest single-version fix sets in Chrome history. Ratings: 7 Critical, 71 High, 170 Medium, 122 Low. Google says most were found internally via AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, AFL, and related toolchains.

Of those 370, CVE-2026-11645 is a V8 out-of-bounds read/write (CVSS 8.8). CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 2026-06-09; it was exploited in the wild before Chrome 151 shipped. Any device still on Chrome 150 or earlier is exposed to confirmed exploitation.

7 new Critical vulnerabilities

Besides the exploited V8 zero-day, Chrome 151 fixes seven new Criticals in core browser components:

• CVE-2026-17650: Compositing use-after-free;
• CVE-2026-17651: Dawn (WebGPU) insufficient validation of untrusted input;
• CVE-2026-17652: Views use-after-free;
• CVE-2026-17653: Skia use-after-free;
• CVE-2026-17654: Updater race condition;
• CVE-2026-17655: ANGLE insufficient validation of untrusted input;
• CVE-2026-17656: Ozone use-after-free.

Triggered via crafted page content, use-after-free can yield arbitrary code execution in the renderer or browser process, then sandbox escape to higher host privileges. Dawn and ANGLE input-validation bugs let attackers push malformed GPU commands into driver paths—especially dangerous on GPU-accelerated workloads. The Updater race can interfere with privileged processes in managed-update or delayed-patch environments.

Exploited V8 zero-day CVE-2026-11645

Nature

CVE-2026-11645 is an out-of-bounds read and write in Chrome's V8 JavaScript engine. CVSS 8.8, CWE-787 (out-of-bounds write). A crafted HTML page is enough to trigger arbitrary code execution inside the browser sandbox.

Exploitation traits

• No user interaction (UI:N);
• No auth or privileges (PR:N);
• Pure web delivery: email, links, or ad slots;
• Combined with sandbox escape → host-level RCE;
• CISA listed it in KEV on 2026-06-09; federal agencies have a mandatory remediation deadline.

Scope

Chrome 150 and earlier on Windows / macOS / Linux / Android. All Chromium-based browsers (Edge, Brave, Opera, Vivaldi, Arc, etc.) and downstream products that have not synced Chromium upstream.

Impact assessment

• Attack surface: the browser is the primary path into enterprise SaaS, cloud apps, internal systems, email, and sensitive data—browser vulns have inherent initial-access value;
• Bar to exploit: low; the seven new Criticals are drive-by (visit a malicious page);
• Impact: renderer RCE, session-cookie theft, password-manager reads, extension/credential exfil, foothold for internal lateral movement;
• Window: after high-profile disclosure, PoC and in-the-wild toolchains typically appear within 48–72 hours.

Remediation

1. Upgrade now

• Windows / macOS: 151.0.7922.71 or 151.0.7922.72;
• Linux: 151.0.7922.71;
• Android: wait for Play Store / OS push of Chrome 151;
• Chromium-based enterprise browsers: upgrade in lockstep.

2. CI and automation

• Playwright: sync `mcr.microsoft.com/playwright` image tags and `@playwright/test` versions to avoid silent headless failures;
• Selenium: upgrade ChromeDriver to match Chrome 151;
• Docker images: rebuild bases with `apt-get update && apt-get install -y google-chrome-stable`;
• macOS 12 Monterey CI: Chrome 151 is the last supported release; no further security updates. Move to macOS 13+.

3. Enterprise hardening

• Browser management policy: block old Chrome, force Stable-channel auto-update;
• Enable Site Isolation for intranet access (on by default; confirm via `chrome://flags/#site-isolation-trial-opt-out`);
• EDR: alert on anomalous Chrome child processes (`sh`, `curl`, `powershell`, `mshta`);
• Watch V8 sandbox-escape chains; extra hardening on GPU-accelerated endpoints (dev machines, 3D design terminals).

4. Developer-facing changes

Chrome 151 has two breaking changes:

• macOS 12 Monterey support ends. Chrome 151 still loads but will not receive further security updates;
• FontFaceSet constructor throws. `new FontFaceSet()` raises `TypeError: Illegal constructor`; use `document.fonts`.

Sources

• Google Chrome 151 Stable Channel update
• NVD CVE-2026-11645 (V8 OOB read/write)
• CISA KEV catalog (added 2026-06-09)
• Cyber Security News: Chrome 151 details
• ByteIota: V8 zero-day in-the-wild analysis
• Enigma Global: Chrome 151 vuln structure and background