Google Chrome 151 Patches 370 Vulnerabilities, Including 7 Critical
What Happened — Google released Chrome 151, addressing 370 security flaws across Windows, macOS, and Linux, with seven classified as Critical. The update is available to all users and should be applied immediately.
Why It Matters for Compliance & Audit Readiness
- Unpatched browsers constitute a control gap in the “System Operations” and “Change Management” criteria of SOC 2; timely patching is required to demonstrate effective risk mitigation.
- Continuous evidence of patch deployment (e.g., patch‑management logs) satisfies audit requirements for control monitoring and provides defensible proof of due diligence.
- Mapping each vulnerability to the relevant security control (e.g., CC6.1 – System Operations) creates a traceable audit trail and reduces the likelihood of a compliance finding.
Who Is Affected – All organizations that permit Chrome on employee workstations or use it in SaaS‑delivered web apps (healthcare, finance, technology, retail, etc.).
Recommended Actions
- Verify that Chrome 151 is deployed across all endpoints via your patch‑management solution.
- Map the seven Critical CVEs to SOC 2 control requirements (e.g., CC6.1, CC7.2) and capture deployment logs as audit evidence.
- Update your vulnerability‑management policy to include a defined timeframe for browser patches and conduct a post‑deployment validation.
Source: TechRepublic
Technical Notes
- Attack vector: Exploitation of browser‑level code execution flaws (remote code execution, privilege escalation).
- CVEs: Seven Critical CVEs (specific IDs disclosed in Chrome release notes) plus 363 lower‑severity flaws.
Source: Chrome 151 release notes