Google Releases Chrome 152 Update With 26 Security Fixes

Google has released Chrome 152.0.7977.75/.76 for Windows and macOS and Chrome 152.0.7977.75 for Linux, addressing 26 security vulnerabilities across the browser. The update includes two critical use-after-free flaws affecting Shared Tab Groups and WebGL, making prompt installation important for both individual and enterprise users. The Stable-channel update is rolling out gradually over the coming days and weeks. Google has not disclosed whether any of the flaws are being actively exploited in the wild. However, the presence of critical memory-safety vulnerabilities means attackers could potentially use specially crafted web content to crash Chrome or gain control within the browser process.

Two Critical Use-After-Free Vulnerabilities Lead Chrome 152’s Security Patch Set

The most severe vulnerabilities in this release are tracked as CVE-2026-84353 and CVE-2026-84352, both rated Critical. CVE-2026-84353 is a use-after-free bug in the Shared Tab Groups feature, which allows users to organize tabs into labeled groups. CVE-2026-84352 affects WebGL, Chrome’s browser technology for rendering interactive 2D and 3D graphics without requiring plug-ins.

A use-after-free vulnerability occurs when a program continues to use a memory pointer after the memory it references has been freed or reallocated. If an attacker can control the contents of that freed memory, the flaw may lead to memory corruption, browser crashes, information disclosure, or arbitrary code execution within the browser’s sandbox. For Critical-rated vulnerabilities, Google typically assumes that exploitation is possible and that the impact could be severe, including full compromise of the browser process.

WebGL bugs are particularly significant because they can be reached through web applications, advertisements, or malicious websites that use graphics-related browser functions. Because WebGL interfaces directly with the GPU, a successful exploit could potentially bypass certain security boundaries and access GPU memory, though Chrome’s sandboxing and site isolation mitigations limit the blast radius.

High-Severity Flaws Across FileSystem, Skia, Omnibox, and Core Components

Beyond the two critical issues, Google fixed eight high-severity vulnerabilities that affect a wide range of browser subsystems. CVE-2026-84354 is an incorrect authorization flaw in the FileSystem API, which could allow a malicious website to read or write files outside the intended origin. CVE-2026-84359 is an information leak in Skia, Chrome’s 2D graphics library, potentially exposing pixel data or memory contents to an attacker.

Judge Seizes Radaris Domains After Privacy Law Violations

Cybersecurity Outlook 2027 Virtual Event Launches

OpenAI gets hacked via Claude-assisted forum exploit

CVE-2026-84357 is an improper input-validation bug in the Omnibox, Chrome’s address bar and search box. Input validation flaws in the Omnibox could be exploited to bypass security checks or trigger unexpected behavior when users type or paste URLs. High-severity use-after-free vulnerabilities were also found in the Proxy component (CVE-2026-84324), the Browser component (CVE-2026-84349), and the Dawn graphics abstraction layer (CVE-2026-84333).

The update also resolves CVE-2026-84326, an uninitialized-resource issue in the V8 JavaScript engine, and CVE-2026-84351, a GPU buffer-overflow vulnerability. Uninitialized memory bugs in V8 can be especially dangerous because they may allow attackers to read sensitive data or craft exploits that lead to code execution. The GPU buffer overflow, meanwhile, could enable an attacker to corrupt memory in the GPU process, which runs in a separate sandbox but still has access to critical graphics resources.

Additional High-Severity Fix: DataTransfer Input Validation

Another high-severity flaw, CVE-2026-84325, is an improper input validation in the DataTransfer component, which handles clipboard operations and drag-and-drop functionality. This vulnerability could allow a malicious website to manipulate clipboard data in ways that bypass security policies, potentially leading to cross-origin data leakage.

Medium- and Low-Severity Issues Addressed Across Multiple Components

The remaining 16 fixes cover medium- and low-severity vulnerabilities. Medium-severity issues include use-after-free in WebRTC (CVE-2026-84347), missing authorization in FileSystem (CVE-2026-84328 and CVE-2026-84323), incorrect authorization in Navigation (CVE-2026-84355), improper privilege management in Downloads (CVE-2026-84358), and incorrect authorization in SiteSettings (CVE-2026-84332).

UI misrepresentation bugs were fixed in FullScreen (CVE-2026-84330) and Chromoting (CVE-2026-84334), along with an information leak in MediaCapture (CVE-2026-84348) and incorrect authorization in TabStrip (CVE-2026-84335). Low-severity fixes cover incorrect authorization in Autofill (CVE-2026-84327), a confused deputy issue in CredentialProvider (CVE-2026-84329), UI misrepresentation in FullScreen (CVE-2026-84356), use-after-free in TabStrip (CVE-2026-84350), and incorrect authorization in Actor (CVE-2026-84331).

Several FileSystem authorization issues were also patched. Google said it may restrict access to bug reports and technical details until most users have installed the update. This practice helps reduce the risk that attackers could weaponize publicly available vulnerability information before systems are patched.

Complete Vulnerability Breakdown: CVE Identifiers, Severity, and Impact

Below is a detailed table of all 26 vulnerabilities fixed in Chrome 152, as provided by Google’s security advisory:

What Is a Use-After-Free Vulnerability and Why Does It Matter for Chrome Users?

A use-after-free vulnerability is a memory corruption bug that occurs when a program attempts to dereference a pointer that has already been freed. In C++-based browsers like Chrome, these bugs are among the most common and dangerous classes of memory safety issues. When a pointer is freed but the program still holds a reference to it, the memory may be reallocated for another purpose. An attacker who can control the contents of that reallocated memory can potentially overwrite function pointers, corrupt data structures, or execute arbitrary code. Because Chrome runs untrusted web content in a sandbox, a use-after-free exploit typically must also chain with a sandbox escape to achieve full system compromise. However, the existence of two critical use-after-free bugs in core components like Shared Tab Groups and WebGL means that the potential attack surface is significant, especially for users who visit untrusted websites or click on ads.

How to Update Chrome to the Latest Version 152.0.7977.75

Users can check for updates by opening Chrome, navigating to Settings, selecting About Chrome, and allowing the browser to download the latest version. The browser will automatically apply the update upon restart. Organizations should verify that managed endpoints receive Chrome 152.0.7977.75 or later as the rollout progresses. For enterprise administrators, group policy or management tools like Google Admin Console can enforce update policies and schedule restarts to minimize disruption. It is recommended to enable automatic updates for the Stable channel to ensure that critical security patches are applied promptly.

Google’s Vulnerability Discovery and Disclosure Process

Google credited internal teams and external security researchers for reporting vulnerabilities during the development cycle. The company also relies on security testing technologies such as AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL to identify bugs before they reach the Stable channel. These tools are part of Google’s broader commitment to memory safety and fuzzing as a primary defense against exploitation. The company’s policy of delaying detailed bug reports until most users have updated helps reduce the window of opportunity for attackers to develop exploits based on published information.

Hands-On Tests Reveal 6 Best VPN Services for 2026

PhantomRaven npm Stealer Likely Built Using LLM

Wiz-Led Cloud Security Market Shifts on $32B Google Deal

Strategic Implications for Enterprise and Individual Users

For enterprise security teams, the presence of two critical vulnerabilities in features that are commonly used — Shared Tab Groups and WebGL — underscores the importance of maintaining a rigorous patch management schedule. WebGL, in particular, is widely used by modern web applications, including productivity tools, design software, and data visualization platforms. An attacker who compromises a legitimate website that uses WebGL could potentially deliver a payload to any visitor’s browser. The medium-severity bugs in FileSystem authorization and privilege management also highlight the need to review browser security policies, especially for organizations that rely on Chrome’s file system APIs for internal applications.

Individual users should prioritize updating Chrome on all devices, including Windows, macOS, and Linux. Because the update is rolling out gradually, some users may not receive it for several days. Checking manually for updates is a prudent step. The low-severity bugs, such as the UI misrepresentation in FullScreen and the confused deputy in CredentialProvider, are less likely to be exploited in widespread attacks but could be used in targeted scenarios.

Why This Update Matters: Context and Comparison with Previous Patches

Chrome 152 follows the release of Chrome 151, which also addressed high-severity flaws. The frequency of critical and high-severity patches in Chrome reflects the browser’s complexity and its position as a primary attack vector for web-based threats. Google’s decision to restrict access to technical details until most users are patched is consistent with its responsible disclosure policy. The company has also been investing heavily in memory-safe languages like Rust and in hardware-based mitigations, but the vast majority of Chrome’s codebase remains in C++, making memory corruption bugs an ongoing challenge.

This update does not include any browser features or changes beyond security fixes, which is typical for a maintenance release. Users should not expect new functionality, but the security improvements are critical for maintaining the integrity of the browsing experience.

Prevent Incidents Due to Slow Investigations: Threat Intelligence Integration

For security operations centers (SOCs) and Tier 1 analysts, timely visibility into threat intelligence is essential for detecting and responding to browser-based attacks. The vulnerabilities in this update could be used in conjunction with phishing campaigns or drive-by download attacks. Integrating threat intelligence lookup services, such as those offered by ANY.RUN, can help analysts correlate suspicious browser behavior with known exploit patterns. By using threat intelligence lookup, SOCs can reduce the time to identify and block malicious domains and IP addresses that attempt to exploit Chrome vulnerabilities.

Organizations are encouraged to evaluate their incident response workflows and ensure that threat intelligence feeds are updated with the latest indicators of compromise related to Chrome 152 vulnerabilities. Proactive monitoring of browser version adherence across endpoints can also help identify unpatched systems before they are targeted.

Users should treat this update as a priority. With two critical memory corruption bugs and a dozen high-severity issues, Chrome 152 is one of the more significant security releases in recent months. The gradual rollout means that not everyone will be protected immediately, but manual updating can close the gap. As web-based attacks continue to evolve, maintaining up-to-date browsers remains one of the most effective defenses against exploitation.