Chrome Patches 300+ Flaws, No Active Exploits
Google Chrome update fixes several hundred vulnerabilities, some enabling arbitrary code execution, with no known in-the-wild exploitation yet.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 10 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Google has released Chrome 151.0.7922.71/.72 (Windows/Mac) and 151.0.7922.71 (Linux) to remediate an unusually large batch of vulnerabilities—well over 300 distinct CVEs spanning use-after-free, out-of-bounds read/write, type confusion, integer overflow, and insufficient input validation issues across nearly every major Chrome subsystem including V8, ANGLE, Skia, Dawn, Media, Extensions, DevTools, Passwords, and Chrome for iOS. The most severe of these could allow an attacker to achieve arbitrary code execution in the context of the logged-on user via a drive-by compromise (T1189), potentially enabling installation of programs, data manipulation, or account creation depending on the victim's privilege level.
MS-ISAC explicitly notes there are no current reports of exploitation in the wild, and the vulnerabilities affect the full range of users—government, business, and home—at a similarly elevated risk rating in each category. Given the scale of the fix (hundreds of CVEs bundled into a single release) but the absence of confirmed active exploitation, this is a standard, high-volume patch cycle rather than an emergent threat. Organizations should prioritize timely deployment via automated patch management, enforce least-privilege configurations, and maintain standard browser-hardening controls (DNS/URL filtering, exploit protection, user training) as outlined in CIS Safeguards.
Because Chrome is deployed at massive scale across consumer and enterprise environments, any subset of these flaws being weaponized post-disclosure would carry significant reach. Defenders should treat this as a mandatory update cycle and monitor vendor/CISA channels for any change in exploitation status.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2026-076
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs