Google has released Chrome 152.0.7977.75/.76 for Windows and macOS and Chrome 152.0.7977.75 for Linux, addressing 26 security vulnerabilities across the browser.

The update includes two critical use-after-free flaws affecting Shared Tab Groups and WebGL, making prompt installation important for both individual and enterprise users.

The Stable-channel update is rolling out gradually over the coming days and weeks. Google has not disclosed whether any of the flaws are being actively exploited in the wild.

However, the presence of critical memory-safety vulnerabilities means attackers could potentially use specially crafted web content to crash Chrome or gain control within the browser process.

Google Fixes 26 Chrome Vulnerabilities

The two critical issues are tracked as CVE-2026-84353 and CVE-2026-84352. CVE-2026-84353 is a use-after-free vulnerability in Shared Tab Groups. At the same time, CVE-2026-84352 affects WebGL, Chrome’s browser technology for rendering interactive 2D and 3D graphics.

A use-after-free bug occurs when software continues to access memory after it has been released. If an attacker can manipulate that memory, the flaw may lead to memory corruption, browser crashes, information disclosure, or code execution.

WebGL bugs are particularly significant because they can be reached through web applications, advertisements, or malicious websites that use graphics-related browser functions.

Google also fixed several high-severity vulnerabilities. These include CVE-2026-84354, an incorrect authorization flaw in FileSystem, CVE-2026-84359, an information leak in Skia; and CVE-2026-84357, an improper input-validation bug in the Omnibox component.

Other high-severity issues include use-after-free vulnerabilities in Proxy, Browser, and Dawn, identified as CVE-2026-84324, CVE-2026-84349, and CVE-2026-84333.

The update also resolves CVE-2026-84326, an uninitialized-resource issue in the V8 JavaScript engine, and CVE-2026-84351, a GPU buffer-overflow vulnerability.

CVE	Severity	Component	Vulnerability
CVE-2026-84353	Critical	Shared Tab Groups	Use-after-free
CVE-2026-84352	Critical	WebGL	Use-after-free
CVE-2026-84354	High	FileSystem	Incorrect authorization
CVE-2026-84359	High	Skia	Information leak
CVE-2026-84357	High	Omnibox	Improper input validation
CVE-2026-84324	High	Proxy	Use-after-free
CVE-2026-84349	High	Browser	Use-after-free
CVE-2026-84326	High	V8	Uninitialized resource
CVE-2026-84333	High	Dawn	Use-after-free
CVE-2026-84351	High	GPU	Buffer overflow
CVE-2026-84325	High	DataTransfer	Improper input validation
CVE-2026-84328	Medium	FileSystem	Missing authorization
CVE-2026-84347	Medium	WebRTC	Use-after-free
CVE-2026-84323	Medium	FileSystem	Missing authorization
CVE-2026-84355	Medium	Navigation	Incorrect authorization
CVE-2026-84358	Medium	Downloads	Improper privilege management
CVE-2026-84332	Medium	SiteSettings	Incorrect authorization
CVE-2026-84330	Medium	FullScreen	UI misrepresentation
CVE-2026-84334	Medium	Chromoting	Incorrect authorization
CVE-2026-84348	Medium	MediaCapture	Information leak
CVE-2026-84335	Medium	TabStrip	Incorrect authorization
CVE-2026-84327	Low	Autofill	Incorrect authorization
CVE-2026-84329	Low	CredentialProvider	Confused deputy
CVE-2026-84356	Low	FullScreen	UI misrepresentation
CVE-2026-84350	Low	TabStrip	Use-after-free
CVE-2026-84331	Low	Actor	Incorrect authorization

The remaining fixes cover medium- and low-severity issues in components including WebRTC, Downloads, Navigation, SiteSettings, FullScreen, Chromoting, MediaCapture, TabStrip, Autofill, CredentialProvider, and Actor.

Several FileSystem authorization issues were also patched. Google said it may restrict access to bug reports and technical details until most users have installed the update.

This practice helps reduce the risk that attackers could weaponize publicly available vulnerability information before systems are patched.

The company credited internal teams and external security researchers for reporting vulnerabilities during the development cycle.

Google also relies on security testing technologies such as AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL to identify bugs before they reach the Stable channel.

Users can check for updates by opening Chrome, navigating to Settings, selecting About Chrome, and allowing the browser to download the latest version. Organizations should verify that managed endpoints receive Chrome 152.0.7977.75 or later as the rollout progresses.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Google Fixes 26 Chrome Vulnerabilities, Including 2 Critical Use-After-Free Flaws appeared first on Cyber Security News.