Google Says Three Chrome Releases Fixed 1,442 Security Flaws
Summary
Google says Chrome 149 and 150 fixed 1,072 security bugs, while Chrome 151 fixed 370 more, including seven critical flaws. It is accelerating releases and exploring dynamic patching, automated dependency updates and memory-safe code to reduce exposure.
Key points
- Google says Chrome versions 149 and 150 fixed 1,072 security bugs—more than the total fixed across the previous 23 milestones combined.
- Chrome 151 fixed another 370 flaws, including seven rated critical.
- A critical sandbox escape, CVE-2026-3545, could let an attacker trick Chrome into reading local files; Google says it patched the flaw in March.
- Google is moving toward two-week major releases and weekly security updates, and is piloting two security releases per week.
- Google is exploring dynamic patching that replaces background browser processes with updated binaries, as well as automatic restarts to apply updates.
- Google says it is adopting memory-safe languages such as Rust, hardening the runtime and automating third-party dependency updates to reduce security flaws.
Article Details
- Event Type
- Google Chrome security updates and vulnerability disclosure
- Impact
- Google fixed 1,072 security bugs across Chrome versions 149 and 150 and another 370 in Chrome 151, including seven critical vulnerabilities. CVE-2026-3545 is a critical sandbox escape that could allow Chrome to read local files; Google says it patched the flaw in March.