Google Chrome 151 (151.0.7922.71/.72) Patches 370 Security Flaws Including 7 Critical Sandbox-Escape / Local-Privilege-Escalation Bugs (CVE-2026-17650 – CVE-2026-17656) — Threadlinqs Intelligence
As of 2026-07-30, Google Chrome 151 (151.0.7922.71/.72) Patches 370 Security Flaws Including 7 Critical Sandbox-Escape / Local-Privilege-Escalation Bugs (CVE-2026-17650 – CVE-2026-17656) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 29 indicators of compromise.
Threat ID: TL-2026-1770 · Severity: CRITICAL · Status: PATCHED · Category: VULNERABILITY
Google's July 29-30, 2026 Chrome 151 stable channel update (151.0.7922.71/.72 Windows/macOS, 151.0.7922.71 Linux) fixes 370 security issues -- 7 critical, 71 high, 170 medium, 122 low. All 7 critical
On July 29-30, 2026, Google published the Chrome 151 stable channel update (chromereleases.googleblog.com), raising the desktop build to 151.0.7922.71/.72 on Windows and macOS and 151.0.7922.71 on Linux, and fixing 370 total security issues (7 critical / 71 high / 170 medium / 122 low per the GBHackers writeup that seeded this threat). The 7 critical issues were independently confirmed against NVD, each carrying a Chromium 'Critical' severity rating and a linked issues.chromium.org tracker entry (still access-restricted, consistent with Google's standard embargo until a majority of users have updated):
- CVE-2026-17650 -- Use-after-free in Compositing (CWE-416): a remote attacker who has already compromised the renderer process can potentially achieve sandbox escape via a crafted HTML page.
- CVE-2026-17651 -- Insufficient validation of untrusted input in Dawn (Chrome's WebGPU implementation) on Android (CWE-20): a remote attacker can potentially perform sandbox escape via a crafted HTML page. This is the only one of the seven scoped specifically to Android.
- CVE-2026-17652 -- Use-after-free in Views, Chromium's cross-platform UI toolkit (CWE-416): same renderer-compromise-to-sandbox-escape pattern as 17650.
- CVE-2026-17653 -- Use-after-free in Skia, Chromium's 2D graphics rendering library (CWE-416): same pattern.
- CVE-2026-17654 -- Race condition in the Chrome Updater on macOS (CWE-362): a LOCAL attacker can perform OS-level privilege escalation via a malicious file. This is the only one of the seven that does not require a prior renderer compromise and does not rely on the 'crafted HTML page' vector -- it is a local, file-based TOCTOU-class updater flaw.
- CVE-2026-17655 -- Insufficient validation of untrusted input in ANGLE, the graphics translation layer Chrome uses to map WebGL/GPU calls to native graphics APIs (CWE-20): sandbox escape via crafted HTML page.
- CVE-2026-17656 -- Use-after-free in Ozone, Chromium's Linux/embedded display-abstraction layer (CWE-416): sandbox escape via crafted HTML page.
Six of the seven (all except the Updater race condition) follow an identical exploit-chain shape documented verbatim in each NVD record: the attacker must first achieve arbitrary code execution inside the sandboxed renderer process (typically via a separate, unpatched renderer-side memory-corruption bug or a scripting-engine flaw, not part of this disclosure), and then trigger the UAF/validation flaw in a lower-privileged-but-still-sandboxed component (Compositing, Views, Skia, Ozone, Dawn, ANGLE) to break out of the Chrome sandbox into the higher-privileged browser process -- i.e., these are second-stage sandbox-escape primitives in a multi-bug exploit chain, not standalone remote-code-execution bugs on their own. This matches the classic Chrome exploit-chain pattern (renderer 1-day/0-day + sandbox-escape 1-day/0-day) used by commercial exploit brokers and APT-affiliated exploit developers.
Google credited a mix of external researchers and internal detection via memory-safety tooling (AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL fuzzing) for the broader 370-bug batch; the source article did not break out individual bounty amounts or named researchers for the 7 critical bugs specifically. Neither the GBHackers source article, the Chrome release blog excerpt, nor a direct CISA KEV catalog check found evidence of active exploitation or a public proof-of-concept for any of the 7 critical CVEs as of 2026-07-30. Given Chrome's dominant global browser market share, the volume of critical memory-safety fixes in a single release, and the fact 6 of 7 are sandbox-escape primitives exploitable via nothing more than a crafted web page (once chained with a renderer bug), this release warrants priority patch rollout even absent confirmed in-the-wild activity.
Weaknesses (CWE)
CWE-416, CWE-20, CWE-362
Target sectors: government administration, finance, health, technology, education, critical-infrastructure, retail, general-enterprise
Target regions: global
Detections & IOCs
As of 2026-07-31, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 29 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-17650, CVE-2026-17651, CVE-2026-17652, CVE-2026-17653, CVE-2026-17654, CVE-2026-17655, CVE-2026-17656, T1592.002, T1587.004, T1588.005, T1189, T1566.002, T1203, T1204.001, T1204.002, T1068, T1548