Google has rolled out a security update to Chrome versions 152.0.7977.75/.76 for Windows and macOS—and 152.0.7977.75 for Linux—fixing 26 vulnerabilities across its browser. This includes two critical use-after-free flaws, pushing an urgent reminder for all users to update promptly.
Critical Bugs in WebGL and Shared Tab Groups
The two most severe issues are CVE-2026-84353 and CVE-2026-84352. The first is a use-after-free bug in Chrome’s Shared Tab Groups feature. The second hits WebGL, which supports interactive 2D/3D graphics on the web. In both cases, the flaw arises when the browser references memory that has already been freed—a scenario that could be manipulated by attackers to crash the browser, expose data, or even execute code.
High-Severity Issues and Broader Risk Profile
Beyond the critical vulnerabilities, the update addresses several high-severity bugs. These include:
- An incorrect authorization flaw in the FileSystem component (CVE-2026-84354).
- An information leak in Skia, the graphics rendering engine (CVE-2026-84359).
- An input validation bug in the Omnibox component (CVE-2026-84357).
Additional high-severity use-after-free problems have been found in components such as Proxy, Browser, and Dawn (CVE-2026-84324, CVE-2026-84349, CVE-2026-84333), along with issues in Chrome’s V8 JavaScript engine and GPU buffer overflow vulnerabilities. Medium- and low-severity bugs affect a wide array of modules, including WebRTC, Downloads, Navigation, SiteSettings, FullScreen, Chromoting, MediaCapture, TabStrip, Autofill, CredentialProvider, and Actor. Several FileSystem authorization bugs were also patched.
Update Rollout & What Users Should Do
The distribution of the stable-channel update is gradual and will proceed over the coming days or weeks. There’s no indication yet that any of the vulnerabilities are being actively exploited.
Users can apply the patch by navigating in Chrome to Settings → About Chrome and letting the update install automatically. Enterprise administrators should verify that managed devices have moved to Chrome 152.0.7977.75 (or newer) as the rollout continues.
The patched vulnerabilities were discovered through a combination of internal security teams and external researchers. Google also leaned into tools like AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity checks, libFuzzer, and AFL to catch issues before they reached general release. Detailed reports for some bugs are being held back until most installations have been updated, a common tactic to prevent premature exploitation.
Analytically, this update underscores both the complexity and stakes of modern browser security. WebGL and Shared Tab Groups expose wide attack surfaces, because they touch interactive graphics rendering and tab management—features heavily relied upon by users and developers alike. The sheer breadth of affected components—from core rendering engines like Skia and V8 to UI surfaces like the Omnibox—signals that attackers benefit from exploring deep architectural interfaces. What to watch now: whether any vulnerabilities become exploit-chains in the wild, how rapidly enterprises can ensure patched endpoints, and how Chrome continues to evolve its automated tools to catch flaws early without compromising performance.
