Google Chrome 152 Patches 327 Security Flaws, Including 10 Critical Vulnerabilities

Google has released Chrome version 152 for Windows, macOS, and Linux, addressing 327 security vulnerabilities, including 10 rated as Critical.

This stable-channel update is being rolled out as version 152.0.7977.64 for Linux and 152.0.7977.64/.65 for Windows and macOS.

This update is significant due to the sheer number and severity of memory-safety issues fixed across Chrome’s user interface, graphics stack, JavaScript engine, networking components, and Chromecast functionality.

Although Google has not indicated that any of these vulnerabilities are currently being exploited in the wild, organizations and users should treat this release as a priority patch, as several flaws could be used in browser exploit chains.

Critical Vulnerabilities in Chrome 152

All 10 Critical vulnerabilities are detailed below. Nine involve use-after-free conditions, a class of memory corruption that may cause browser crashes or allow arbitrary code execution if successfully exploited. The remaining flaw is an improper input-validation issue in Chromecast.

CVE ID	Severity	Vulnerability	Affected Component	Reporter	Reward
CVE-2026-79282	Critical	Use-after-free	ANGLE	Goodluck	$25,000
CVE-2026-79290	Critical	Use-after-free	Aura	Google	N/A
CVE-2026-79054	Critical	Use-after-free	Chromecast	Google	N/A
CVE-2026-79121	Critical	Improper input validation	Chromecast	Google	N/A
CVE-2026-79224	Critical	Use-after-free	Chromecast	Google	N/A
CVE-2026-79052	Critical	Use-after-free	Aura	Google	N/A
CVE-2026-79150	Critical	Use-after-free	Views	Google	N/A
CVE-2026-78935	Critical	Use of uninitialized variable	Mobile	Google	N/A
CVE-2026-79012	Critical	Use-after-free	Safe Browsing	Google	N/A
CVE-2026-79200	Critical	Use-after-free	Aura	Google	N/A

The most significant externally reported issue, CVE-2026-79282, affects ANGLE, Chrome’s graphics translation layer. ANGLE translates graphics API calls for rendering on different platforms.

It has historically been a high-value attack surface due to its processing of complex web-delivered graphics content. Google awarded researcher Goodluck $25,000 for reporting this flaw.

High-Severity Vulnerabilities

Chrome 152 also resolves numerous High-severity flaws affecting ANGLE, V8, WebRTC, Extensions, GPU, WebGL, Aura, Chromecast, Bluetooth, Autofill, FedCM, and browser sandbox components.

The disclosed vulnerability classes include out-of-bounds reads and writes, buffer overflows, type confusion, integer overflow, use-after-free, race conditions, authorization failures, information leaks, and UI misrepresentation.

Several High-severity bugs are particularly important for defenders monitoring browser exploitation:

CVE ID	Vulnerability	Component
CVE-2026-78989	Out-of-bounds read	ANGLE
CVE-2026-79069	Memory corruption	Tint
CVE-2026-79218	Incorrect authorization	Sandbox
CVE-2026-79019	Out-of-bounds write	ANGLE
CVE-2026-79187	Use-after-free	WebRTC
CVE-2026-79130	Buffer overflow	ANGLE
CVE-2026-78948	Buffer overflow	WebGL
CVE-2026-78908	Information leak	Canvas
CVE-2026-78938	Type confusion	V8
CVE-2026-78952	Out-of-bounds write	Crashpad
CVE-2026-79236	Type confusion	V8
CVE-2026-79078	Use-after-free	FedCM

Chrome’s V8 JavaScript engine has received fixes for High-severity type confusion bugs. At the same time, ANGLE has been patched for several memory corruption issues, including out-of-bounds writes, buffer overflows, type confusion, and use-after-free vulnerabilities. These components are commonly exploited through malicious web content.

Medium and Low Severity Fixes

The remaining fixes are categorized as Medium or Low severity and address Chrome’s networking stack, Site Isolation, DevTools, Web Authentication, USB, WebXR, file handling, Extensions, Custom Tabs, Service Workers, permissions, payments, media, DOM, GPU, Skia, V8, WebView, and enterprise features.

Google’s advisory also notes defects related to missing authorization, incorrect authorization, information disclosure, race conditions, UI spoofing, resource lifetime errors, and insufficient input validation.

Google has indicated that some technical bug details and links will remain restricted until most Chrome users have installed the update.

This standard disclosure practice aims to minimize the opportunity for attackers to exploit public vulnerability details against unpatched systems.

Administrators should prioritize deploying Chrome 152 across managed Windows, macOS, and Linux systems. Users can verify their installed version by navigating to chrome://settings/help, which initiates Chrome’s built-in update check. A browser restart is required to complete the installation.

Security teams should also ensure that Chromium-based browsers are updated as their vendors release corresponding fixes. Google recognizes both external researchers and internal teams, noting that tools like sanitizers, Control Flow Integrity, libFuzzer, and AFL help identify security issues before they reach the stable channel.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC