Chrome 151 Patched Over 400 Flaws: A Case Study in Why Human Hackers Still Beat AI at Finding Critical Bugs

In the span of two weeks, Google released a pair of Chrome 151 security updates that patched a staggering 411 documented vulnerabilities—including a V8 zero-day already being exploited in the wild. The July 29 update fixed 370 flaws (7 critical), and the August 7 follow-up fixed another 41 (6 critical) .

But the headline number isn't the full story. What makes Chrome 151 a landmark release for security professionals is what it reveals about how those bugs were found: roughly 90% by Google's AI-powered fuzzing and sanitizer pipelines, and the rest by human bug bounty hunters who found the kinds of flaws that automation simply misses .

Here is the full breakdown of the vulnerabilities, the researchers, and what this tells us about the future of vulnerability discovery.

Critical Vulnerabilities in Chrome 151: A Two-Wave Attack Surface Cleanup

July 29 Release (370 flaws, 7 critical)

This release shipped as Chrome 151.0.7922.71/.72 for Windows, macOS, and Linux (with Android receiving version 151.0.7922.71/.72 as well) . The seven critical CVEs—CVE-2026-17650 through CVE-2026-17656—included:

• Use-after-free bugs in Compositing, Views, Skia, and Ozone .
• Insufficient validation flaws in Dawn and the ANGLE graphics translation layer .
• A race condition in the Updater component .

Most critically, one of the patched vulnerabilities—CVE-2026-11645, a V8 out-of-bounds read and write (CVSS 8.8)—was already on CISA's Known Exploited Vulnerabilities catalog before the release, meaning attackers had already weaponized it .

August 7 Release (41 flaws, 6 critical)

Shipped as versions 151.0.7922.108/.109 for Windows and macOS, this update added another six critical-severity CVEs (CVE-2026-19137 through CVE-2026-19172) . The critical bugs consisted of:

• Five use-after-free vulnerabilities in WebGL (2), Aura, Skia, and Views .
• An out-of-bounds write in the ANGLE graphics engine .

Of the 35 high-severity issues in this release, 24 were memory-safety bugs .

A Note on Counting

The vulnerability total across Chrome 151's lifecycle is not entirely clean. Some early-June reports reference a build that patched 382 flaws (including 15 critical), though reporting is inconsistent on whether those numbers reflect overlapping fixes or pre-stable-channel patches . The figures used here—370 and 41—come from the two definitive stable-channel releases documented by multiple security outlets.

The AI vs. Human Bug-Hunting Scorecard

Discovery method	July 29 release (370 flaws)	August 7 release (41 flaws)
Google internal (fuzzing + AI tools)	~349 bugs found internally	~29 bugs found internally
External bug bounty researchers	~21-24 findings	12 findings
Total bounty payouts	$58,500 (across all external reports)	Reported amounts: $5,000 (CVE-2026-19169) + two $500 payments

What AI and Automation Found

Google's internal security teams rely on a suite of advanced fuzzing and memory-sanitizer tools—AddressSanitizer, MemorySanitizer, and Control Flow Integrity—which scan code paths for memory corruption patterns . Many of these pipelines now incorporate machine-learning-based fuzzing to guide testing toward complex, high-risk code .

Automated tools excel at finding the "known unknown" patterns—use-after-free bugs, buffer overflows, and uninitialized memory—through pattern recognition and code-coverage-guided testing. In the July release, Google discovered 349 of the 370 bugs internally, roughly 80-90% of the total .

What Human Researchers Found That AI Missed

The external bounty community contributed a smaller but strategically critical set of findings:

• July 29 release: External researchers found roughly 24 bugs, earning bounties from $2,000 to $36,000. The largest single payout was $36,000 for a GPU use-after-free bug (CVE-2026-13789) .

• August 7 release: Nearly a third of the 41 high-severity findings (12 bugs) came from human hunters . Named researchers included Muhammad Alifa Ramdhan, Pan ZhenPeng, and Billy Jheng Bing Jhong of STAR Labs SG Pte. Ltd., who reported a WebGL use-after-free bug (CVE-2026-19170) . Another WebGL critical bug (CVE-2026-19137) was reported anonymously . Google also awarded $5,000 to SungHyun Kim for CVE-2026-19169, an insufficient validation flaw in Contextual Tasks .

What these human-discovered bugs share is that they required creative adversarial reasoning: chaining multiple components, exploiting race conditions, or reasoning about edge-case program flow that fuzzers failed to trigger .

Microsoft's Memory-Safety Move and Chrome's Rust Shift

One notable architectural change in Chrome 151 wasn't a vulnerability fix but a prevention strategy: Google updated Chrome's XML parsing engine to a memory-safe Rust implementation for common scenarios where XSLT is not required . This mirrors a broader industry trend, with Microsoft and other vendors increasingly adopting Rust to eliminate entire classes of memory-safety bugs at the source .

Rust-based rewrites won't catch every bug—logic flaws and design issues exist independently of memory safety—but they directly address the category (use-after-free, buffer overflows) that accounted for the vast majority of Chrome 151's critical vulnerabilities. Google found 349 of 370 bugs internally in July—most through memory-sanitizer tools that detect exactly these patterns.

The Practical Takeaway: Complementarity, Not Replacement

Chrome 151 is a clear case study in what security experts mean when they say AI is a force multiplier, not a silver bullet:

• AI excels at volume and recall. Automated fuzzing and sanitizers found the overwhelming majority of bugs, especially the memory-safety issues that follow predictable patterns .
• Human researchers provide depth and novelty. The bugs that humans found—like the V8 zero-day (CVE-2026-11645) and the WebGL use-after-free vulnerabilities—required reasoning about multi-component interactions and adversarial scenarios that no existing fuzzer can model .
• The winning model is human-guided automation. AI handles the "known unknown" patterns at massive scale, freeing human researchers to concentrate on the "unknown unknown" bugs—the logic flaws, chainable exploits, and corner cases that no sanitizer can define in advance.

Chrome 151's combined tally of 411+ fixes would not have been achievable through either approach alone. As one Forbes analysis noted, nearly 30% of the vulnerabilities in the August 7 update were uncovered by bug bounty hunters —a proportion that strongly argues against the narrative that human researchers are being replaced.

What Users Should Do

Chrome 151 for desktop should update automatically, but users can verify by navigating to Settings > About Chrome to ensure they are running version 151.0.7922.108/.109 or later . Android users should check their system settings for the latest Chrome update (151.0.7922.71/.72) . Given that one of the patched vulnerabilities (CVE-2026-11645) was already under active exploitation, delaying the update is not advisable .