Google Chrome Update Patches 2 Critical Use-After-Free Vulnerabilities

Key Takeaways

• Google has released an urgent update for Chrome, version 152.0.7977.75/.76 for Windows and macOS, and 152.0.7977.75 for Linux.
• The update addresses 26 security vulnerabilities, including two critical use-after-free flaws in Shared Tab Groups and WebGL.
• These critical vulnerabilities (CVE-2026-84353 and CVE-2026-84352) could lead to browser crashes or arbitrary code execution.
• Users and organizations are strongly advised to update Chrome immediately to mitigate potential exploitation risks, though active exploitation has not been confirmed.

Google Chrome Receives Critical Security Update Addressing 26 Vulnerabilities

Google has rolled out a significant security update for its Chrome browser, bringing the stable channel to version 152.0.7977.75 for Linux and 152.0.7977.75/.76 for Windows and macOS. This crucial release resolves a total of 26 security flaws, with two identified as critical use-after-free vulnerabilities that demand immediate attention from all users.

The update, which is being deployed incrementally over the coming days and weeks, aims to safeguard users against potential threats stemming from these defects. While Google has not confirmed any active exploitation of these vulnerabilities in the wild, the severity of the critical issues underscores the importance of prompt patching.

Two Critical Use-After-Free Vulnerabilities Highlight Update Urgency

Among the 26 patched vulnerabilities, two critical use-after-free bugs stand out: CVE-2026-84353 and CVE-2026-84352. CVE-2026-84353 impacts the Shared Tab Groups feature, while CVE-2026-84352 affects WebGL, Chrome’s technology for rendering interactive 2D and 3D graphics directly within the browser.

Use-after-free vulnerabilities arise when a program attempts to access memory that has already been deallocated. This can lead to various severe consequences, including memory corruption, application crashes, sensitive information disclosure, or even arbitrary code execution if an attacker can manipulate the freed memory region. The nature of WebGL vulnerabilities is particularly concerning as they can be triggered through malicious web content, advertisements, or compromised websites leveraging graphics functionalities.

High-Severity Flaws Also Addressed

Beyond the critical issues, the update also resolves several high-severity vulnerabilities. These include CVE-2026-84354, an incorrect authorization flaw in the FileSystem component; CVE-2026-84359, an information leak within Skia; and CVE-2026-84357, an improper input validation bug affecting the Omnibox. Additional high-severity use-after-free vulnerabilities were patched in the Proxy (CVE-2026-84324), Browser (CVE-2026-84349), and Dawn (CVE-2026-84333) components.

Other notable high-severity fixes include CVE-2026-84326, an uninitialized resource flaw in the V8 JavaScript engine, and CVE-2026-84351, a buffer-overflow vulnerability related to the GPU.

The remaining patches address a range of medium and low-severity issues across various components, including WebRTC, Downloads, Navigation, SiteSettings, FullScreen, Chromoting, MediaCapture, TabStrip, Autofill, CredentialProvider, and Actor. Several FileSystem authorization vulnerabilities were also mitigated.

Google said it might temporarily restrict access to detailed bug reports and technical information. This standard practice helps prevent threat actors from weaponizing vulnerability details before a significant portion of the user base has updated their browsers.

Google acknowledged contributions from both its internal security teams and external researchers for identifying these vulnerabilities. The company also highlighted its reliance on advanced security testing technologies, such as AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL, to proactively detect and remediate bugs during the development cycle.

What You Should Do

• Update Chrome Immediately: Open your Chrome browser, navigate to Settings (the three-dot menu), then select “About Chrome.” The browser will automatically check for and download the latest update. Restart Chrome when prompted.
• Verify Version: Ensure your Chrome browser is updated to version 152.0.7977.75 (for Linux) or 152.0.7977.75/.76 (for Windows and macOS) or later.
• For Organizations: System administrators should confirm that all managed Chrome endpoints receive and install the update promptly to protect enterprise environments.
• Stay Vigilant: While no active exploitation has been confirmed, critical vulnerabilities can be weaponized quickly. Keep all software, especially web browsers, up to date.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.