Google has released Chrome 152.0.7977.75/.76 for Windows and macOS and Chrome 152.0.7977.75 for Linux, addressing 26 security vulnerabilities across the browser.
The update includes two critical use-after-free flaws affecting Shared Tab Groups and WebGL, making prompt installation important for both individual and enterprise users.
The Stable-channel update is rolling out gradually over the coming days and weeks. Google has not disclosed whether any of the flaws are being actively exploited in the wild.
However, the presence of critical memory-safety vulnerabilities means attackers could potentially use specially crafted web content to crash Chrome or gain control within the browser process.
Google Fixes 26 Chrome Vulnerabilities
The two critical issues are tracked as CVE-2026-84353 and CVE-2026-84352. CVE-2026-84353 is a use-after-free vulnerability in Shared Tab Groups. At the same time, CVE-2026-84352 affects WebGL, Chrome’s browser technology for rendering interactive 2D and 3D graphics.
A use-after-free bug occurs when software continues to access memory after it has been released. If an attacker can manipulate that memory, the flaw may lead to memory corruption, browser crashes, information disclosure, or code execution.
WebGL bugs are particularly significant because they can be reached through web applications, advertisements, or malicious websites that use graphics-related browser functions.
Google also fixed several high-severity vulnerabilities. These include CVE-2026-84354, an incorrect authorization flaw in FileSystem, CVE-2026-84359, an information leak in Skia; and CVE-2026-84357, an improper input-validation bug in the Omnibox component.
Other high-severity issues include use-after-free vulnerabilities in Proxy, Browser, and Dawn, identified as CVE-2026-84324, CVE-2026-84349, and CVE-2026-84333.
The update also resolves CVE-2026-84326, an uninitialized-resource issue in the V8 JavaScript engine, and CVE-2026-84351, a GPU buffer-overflow vulnerability.
| CVE | Severity | Component | Vulnerability |
|---|---|---|---|
| CVE-2026-84353 | Critical | Shared Tab Groups | Use-after-free |
| CVE-2026-84352 | Critical | WebGL | Use-after-free |
| CVE-2026-84354 | High | FileSystem | Incorrect authorization |
| CVE-2026-84359 | High | Skia | Information leak |
| CVE-2026-84357 | High | Omnibox | Improper input validation |
| CVE-2026-84324 | High | Proxy | Use-after-free |
| CVE-2026-84349 | High | Browser | Use-after-free |
| CVE-2026-84326 | High | V8 | Uninitialized resource |
| CVE-2026-84333 | High | Dawn | Use-after-free |
| CVE-2026-84351 | High | GPU | Buffer overflow |
| CVE-2026-84325 | High | DataTransfer | Improper input validation |
| CVE-2026-84328 | Medium | FileSystem | Missing authorization |
| CVE-2026-84347 | Medium | WebRTC | Use-after-free |
| CVE-2026-84323 | Medium | FileSystem | Missing authorization |
| CVE-2026-84355 | Medium | Navigation | Incorrect authorization |
| CVE-2026-84358 | Medium | Downloads | Improper privilege management |
| CVE-2026-84332 | Medium | SiteSettings | Incorrect authorization |
| CVE-2026-84330 | Medium | FullScreen | UI misrepresentation |
| CVE-2026-84334 | Medium | Chromoting | Incorrect authorization |
| CVE-2026-84348 | Medium | MediaCapture | Information leak |
| CVE-2026-84335 | Medium | TabStrip | Incorrect authorization |
| CVE-2026-84327 | Low | Autofill | Incorrect authorization |
| CVE-2026-84329 | Low | CredentialProvider | Confused deputy |
| CVE-2026-84356 | Low | FullScreen | UI misrepresentation |
| CVE-2026-84350 | Low | TabStrip | Use-after-free |
| CVE-2026-84331 | Low | Actor | Incorrect authorization |
The remaining fixes cover medium- and low-severity issues in components including WebRTC, Downloads, Navigation, SiteSettings, FullScreen, Chromoting, MediaCapture, TabStrip, Autofill, CredentialProvider, and Actor.
Several FileSystem authorization issues were also patched. Google said it may restrict access to bug reports and technical details until most users have installed the update.
This practice helps reduce the risk that attackers could weaponize publicly available vulnerability information before systems are patched.
The company credited internal teams and external security researchers for reporting vulnerabilities during the development cycle.
Google also relies on security testing technologies such as AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL to identify bugs before they reach the Stable channel.
Users can check for updates by opening Chrome, navigating to Settings, selecting About Chrome, and allowing the browser to download the latest version. Organizations should verify that managed endpoints receive Chrome 152.0.7977.75 or later as the rollout progresses.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
The post Google Fixes 26 Chrome Vulnerabilities, Including 2 Critical Use-After-Free Flaws appeared first on Cyber Security News.