Google has just rolled out Chrome version 152 (versions 152.0.7977.64 for Linux; 152.0.7977.64/.65 for Windows and macOS) packed with 327 security patches. Among these are 10 critical vulnerabilities, putting this release high on the list for urgent updates, especially for users handling sensitive data or operating in enterprise environments. Availability will spread to all channels over the coming days.
The most severe weaknesses center on memory-safety bugs, especially “use-after-free” flaws—situations where Chrome keeps using memory that should’ve been released. These kinds of bugs can let an attacker crash the browser, steal data, or even execute code under Chrome’s permissions.
What got fixed
Some standout vulnerabilities include:
- CVE-2026-79282: a use-after-free issue in the ANGLE graphics layer, discovered by a security researcher who earned a $25,000 reward;
- Multiple use-after-free bugs in Chrome’s user interface framework, Aura, and in Chromecast;
- An improper input validation flaw in Chromecast;
- An uninitialized-variable issue in the Mobile build;
- A use-after-free vulnerability in Safe Browsing.
Other high-severity fixes tackle weaknesses across ANGLE, WebGL, V8 (JavaScript engine), WebRTC, Extensions, Autofill, GPU, Bluetooth, sandboxing, and password handling. Problems addressed include buffer overflows, out-of-bounds memory access, type confusion, race conditions, and information leaks—so even components that seem peripheral could expose critical risk.
What users should do now
No evidence currently suggests these flaws are being exploited in the wild. That said, Google is holding back detailed exploit information until a majority of Chrome users have updated. Some restrictions may persist for issues originating from third-party libraries with unresolved dependencies elsewhere.
If you’re running Chrome, update immediately: open the browser menu > Help > About Google Chrome, then relaunch after the update finishes. For organizations, ensure managed devices receive Chrome 152 via your standard deployment channels.
Why this matters: Chrome remains one of the primary battlefronts in influencing security at the browser level, where memory and rendering components are frequent targets. Every major patch like this reduces the attack surface that adversaries try to exploit.
In short: update now. Delay could leave you exposed.
This update bolsters Chrome’s security framework but also acts as a reminder. Software this complex will always have holes—and threat actors will probe them.
