chrome just shipped 370 security fixes in one update — and found the scariest ones itself

Google shipped Chrome 151.0.7922.71/.72 to the stable channel starting July 29, 2026, and buried in the changelog is a number that should make anyone using the browser pause: 370 security issues fixed in one release. Seven are rated Critical. Four of those are use-after-free bugs — the kind of memory-corruption flaw that, in the wrong hands, turns a malicious webpage into a way to run arbitrary code on your machine. Google's own engineers found all four before anyone outside the company got the chance.

What a 'use-after-free' bug actually does

Skip the jargon for a second. A use-after-free happens when a program frees up a chunk of memory — tells the computer 'I'm done with this, you can reuse it' — but then a stray pointer somewhere still tries to read or write to that same spot. If an attacker can control what gets loaded into that freed memory before the stray pointer fires, they can potentially hijack the program's execution. In a browser, that trigger can be as simple as visiting a page with the right malicious JavaScript on it. No download, no fake install button — just landing on the page can be enough to start the chain, though turning that into working code execution still takes real exploit engineering on top.

Why it matters that Google found these, not a researcher

Most Critical Chrome CVEs carry a researcher's name and a payout attached — someone reports a working exploit chain through Google's bug bounty program and collects, sometimes a five-figure sum for a good use-after-free chain. Not this batch. Google's own security team found and fixed all four Critical bugs internally, before any outside researcher had the chance to report — or sell — them. My honest read: that's the good outcome. A bug Google catches with its own fuzzing infrastructure never had a window where only an attacker knew it existed. It also says something less flattering about Chrome's foundations — this many use-after-free bugs keep surfacing because huge parts of Chromium are still C++, a language where this entire bug class is trivially easy to introduce and brutally hard to fully audit away.

This is at least the third 300+ fix update this year

Zoom out and the pattern is the real story. Chrome shipped an update with 382 security fixes in July, and one with 28 fixes — several critical — earlier in the year, per Born's Tech and Windows World's release tracking. Three-hundred-plus-bug updates used to be rare events; now they're closer to routine. It fits a pattern we've tracked all year — a Windows AD FS zero-day exploited in the wild, a VMware ESXi bug that let a VM take over its host — 2026 has been a genuinely rough year for 'patch now' advisories across the entire stack, not just browsers. That's partly Chrome getting bigger, and partly Google's fuzzing catching more before ship, which is the less alarming explanation and probably the more accurate one.

None of this means panic — zero known exploitation is the actual headline, buried under the scarier one. But it's worth sitting with how normal this has become: a browser used by billions patching hundreds of memory-safety bugs every few weeks, largely because it's still built on a language from 1985 that was never designed to be memory-safe. This isn't a Chrome-specific problem — the same root cause runs through big enterprise CVE waves like the SharePoint exploitation wave and July's record-breaking Patch Tuesday. If you only patch one thing this week, patch the browser — it's the software with the most exposure to the open internet on your machine, full stop.