Google Chrome 152 Patches 327 Flaws, Including 10 Critical Security Vulnerabilities

Google has released Chrome 152 for Windows, macOS, and Linux, delivering a major security update that addresses 327 vulnerabilities, including 10 rated Critical. The Stable channel release is available as Chrome 152.0.7977.64 for Linux and 152.0.7977.64/.65 for Windows and macOS.

The extensive security patch highlights the continued importance of keeping web browsers updated, particularly as modern browser components process large volumes of potentially malicious web content.

The Chrome 152 update addresses vulnerabilities across numerous browser components, including the graphics stack, browser interface, JavaScript engine, networking functionality, Safe Browsing, WebRTC, Chromecast, WebGL, Canvas, and the Chrome sandbox.

Google Chrome 152 Patches 327 Flaws

The flaws include memory-safety weaknesses, improper authorization, input-validation problems, information disclosure, and other implementation errors that could potentially result in crashes, data exposure, or arbitrary code execution depending on exploitation conditions.

Among the most significant vulnerabilities is CVE-2026-79282, a Critical-rated use-after-free vulnerability affecting ANGLE, Chrome’s graphics translation layer. ANGLE translates graphics API calls between different graphics backends and therefore processes complex content that can originate from websites.

Google awarded security researcher Goodluck $25,000 for reporting the issue. A successful memory-corruption attack against a graphics component could potentially allow malicious web content to compromise browser processes or execute attacker-controlled code.

Chrome 152 also resolves Critical vulnerabilities affecting Aura, Chromecast, Views, Safe Browsing, and mobile functionality.

Several of the Critical issues involve use-after-free conditions, in which software continues accessing memory after that memory has already been released.

Such flaws can create memory-corruption conditions that attackers may exploit to manipulate application behavior. Other Critical findings include an improper input-validation vulnerability in Chromecast and a use-of-uninitialized-variable issue affecting mobile code.

The release also contains numerous High-severity vulnerabilities affecting components that frequently interact with untrusted content.

ANGLE received fixes for out-of-bounds reads and writes, buffer overflows, and other memory-corruption weaknesses. Chrome’s V8 JavaScript and WebAssembly engine was also affected by High-severity type-confusion vulnerabilities.

Type confusion occurs when software incorrectly treats an object as a different data type, potentially enabling unintended memory access or corruption.

Because JavaScript can be delivered directly through malicious or compromised websites, vulnerabilities in V8 remain an important browser security concern.

Other High-severity flaws addressed in Chrome 152 affect WebRTC, WebGL, Canvas, Crashpad, FedCM, and the sandbox.

These weaknesses demonstrate how a successful browser attack can potentially involve multiple security boundaries. An attacker may begin with specially crafted web content and attempt to exploit a memory-safety issue before targeting browser sandbox protections or other privileged functionality. The combination of multiple vulnerabilities can significantly increase the impact of a browser compromise.

Beyond the Critical and High-severity findings, Google has fixed Medium- and Low-severity security issues across networking, Site Isolation, DevTools, Web Authentication, USB, WebXR, file handling, Extensions, Service Workers, permissions, payments, media, DOM, GPU, Skia, WebView, and enterprise features.

Google is withholding some technical vulnerability details and bug information until a larger portion of the Chrome user base has installed the update, reducing the opportunity for attackers to develop exploits against unpatched systems.

Organizations should prioritize deploying Chrome 152 across managed Windows, macOS, and Linux endpoints. Administrators should verify that enterprise-managed devices have received the latest build and monitor security telemetry for suspicious browser behavior.

Individual users can check their installed version through chrome://settings/help; Chrome will check for updates and require a restart to activate the patched release.

Given the number and severity of vulnerabilities addressed, delaying the update could leave endpoints exposed to browser-based attacks using malicious websites, advertisements, or compromised online services.