Google has released a major security update for Chrome 152, addressing more than 300 vulnerabilities, including over 10 issues classified as critical and capable of affecting both individual users and enterprise environments.
The most serious vulnerabilities involve memory-safety problems such as use-after-free bugs, which can potentially allow attackers to crash the browser, expose sensitive information or, in more serious circumstances, execute code within the Chrome process.
Given how heavily Chrome is used for online banking, corporate applications, cloud services and everyday browsing, users and organisations should make sure their browsers are updated as soon as the fixed release becomes available.
Several Critical Chrome Components Are Affected
The security flaws are spread across a number of important Chrome subsystems.
One critical vulnerability affects ANGLE, the graphics translation layer used by Chrome, while other serious issues involve components such as Aura, Chromecast, Views, Safe Browsing and Chrome's mobile code.
Many of the highest-severity bugs are use-after-free vulnerabilities.
These occur when software continues trying to access an area of memory after that memory has already been released.
Under the right circumstances, an attacker may be able to manipulate that behaviour to cause unexpected application behaviour or execute malicious code.
For a browser, this is particularly concerning because users routinely open websites containing code and content supplied by untrusted third parties.
CVE-2026-79282 Affects Chrome's ANGLE Graphics Layer
Among the vulnerabilities listed in the update is CVE-2026-79282, a use-after-free issue affecting ANGLE.
The vulnerability carries a CVSS score of 9.6, placing it firmly within the critical range.
ANGLE plays an important role in translating graphics APIs used by websites into commands that can work across different graphics systems and operating systems.
Because modern websites increasingly rely on hardware-accelerated rendering and graphical APIs, vulnerabilities affecting this layer can become particularly serious.
The security table on page 1 also identifies several other critical vulnerabilities carrying similarly high severity scores.
Aura Is Hit by Multiple Critical Vulnerabilities
Chrome's Aura user-interface framework is another major area affected by the update.
The fixed issues include:
Aura provides important parts of Chrome's user-interface infrastructure, making memory-safety problems in this area worth treating seriously.
Multiple vulnerabilities affecting the same broad subsystem also demonstrate why browser updates often contain large collections of fixes rather than one isolated security correction.
Chromecast Also Receives Several Fixes
Google patched several vulnerabilities affecting the Chromecast-related components within Chrome.
These include:
All three carry a CVSS score of 8.3 in the advisory's table.
Improper input validation is a different class of vulnerability from use-after-free.
It generally occurs when software fails to adequately check information before processing it.
If an attacker can supply specially crafted input that the application assumes is valid, unexpected behaviour can follow.
Safe Browsing Itself Had a Critical Memory Bug
One particularly notable vulnerability affects Chrome Safe Browsing, the technology designed to help protect users from malicious websites and dangerous downloads.
Tracked as CVE-2026-79012, the issue is another use-after-free vulnerability and carries a CVSS score of 9.6.
That does not mean Safe Browsing itself suddenly becomes unsafe as a concept.
It simply demonstrates that security components are still software, and software can contain bugs just like everything else.
This is one reason browser updates remain important even for users who already practise careful browsing habits.
Mobile and Views Components Are Also Patched
The update includes another high-impact use-after-free vulnerability in Views, tracked as CVE-2026-79150, together with an uninitialised-variable issue affecting Chrome's Mobile component, tracked as CVE-2026-78935.
Both are listed with a CVSS score of 9.6.
An uninitialised-variable vulnerability occurs when software uses a variable before a proper value has been assigned to it.
Depending on how the memory happens to be populated, this can produce unpredictable behaviour and potentially expose information or create opportunities for exploitation.
These kinds of bugs are why modern browser development increasingly relies on memory-safe programming techniques, sandboxing and several layers of exploit mitigation.
More Than Just the Critical Vulnerabilities Were Fixed
The Chrome 152 release contains far more than the small set of critical vulnerabilities highlighted in the advisory.
Google also patched a large number of high-severity flaws affecting components including:
The vulnerability classes include buffer overflows, out-of-bounds reads and writes, type confusion, authorisation problems, race conditions and information leaks.
That illustrates how complex a modern browser has become.
Chrome is no longer simply an application that displays HTML pages.
It contains JavaScript engines, graphics pipelines, media processing, password management, extension systems, hardware acceleration, Bluetooth functionality, WebRTC communications and countless other subsystems.
The larger that attack surface becomes, the more important regular browser updates are.
Google Has Not Confirmed Active Exploitation
The good news is that Google has not publicly stated that any of the vulnerabilities fixed in this release are currently being actively exploited in the wild.
That distinguishes this update from emergency browser patches where attackers are already using a zero-day vulnerability against users.
However, the absence of confirmed exploitation should not be interpreted as a reason to delay updating.
Once vulnerability details become public, attackers can begin studying the patches and attempting to reverse engineer what was fixed.
That is one reason Google temporarily limits access to detailed bug information until a sufficiently large portion of Chrome users have upgraded.
It reduces the amount of immediate information available to attackers while vulnerable installations remain widespread.
Which Chrome Versions Are Vulnerable?
The vulnerabilities affect Chrome versions earlier than:
Linux
Windows and macOS
These are the fixed versions identified in the advisory.
If your browser is running an earlier release, it should be updated.
Chrome normally installs updates automatically in the background, but the browser may still require a restart before the new version becomes active.
Users who rarely close Chrome can therefore remain on an older build longer than they realise.
How to Check Your Chrome Version
Updating Chrome manually is straightforward.
Open Chrome and navigate to:
Chrome will automatically check for available updates.
Once the update finishes downloading, relaunch the browser to activate the new version.
After restarting, verify that the version number matches or exceeds the fixed release appropriate for your operating system.
For enterprise environments, administrators should confirm that managed endpoints are receiving the update through their normal deployment or management channels.
Enterprise Users Should Verify Deployment, Not Assume It Happened
For individual users, Chrome's automatic update mechanism normally handles patches reasonably well.
Enterprise environments can be more complicated.
Companies may delay browser updates for compatibility testing, use managed update policies or operate systems that are not frequently restarted.
That means security teams should verify actual deployment rather than assuming every workstation has already updated.
A dashboard showing that an update was approved is not the same as confirming that every endpoint is actually running the fixed version.
Organisations should especially check systems used to access sensitive internal applications, privileged administration portals and financial services.
Browsers Remain One of the Most Important Security Boundaries
Web browsers are among the most exposed applications on almost every computer.
They constantly process content received from the internet.
A user does not necessarily need to intentionally download malware for a browser vulnerability to become relevant.
A compromised or malicious website may be enough to trigger an exploit if the browser contains the right weakness.
Chrome includes several layers of defence, including process sandboxing and site isolation, but attackers frequently attempt to chain multiple vulnerabilities together to escape those protections.
That makes quickly patching memory-safety bugs particularly important.
Why Use-After-Free Bugs Keep Appearing
Use-after-free vulnerabilities have appeared repeatedly across browsers and other large software projects.
They are largely associated with complex memory management.
Software allocates memory, uses it and eventually releases it.
If another piece of code still holds a reference to that memory and attempts to access it later, unexpected behaviour can occur.
Attackers may sometimes manipulate the memory that replaces the released data, turning a simple crash into something much more serious.
This category of vulnerability is one reason the software industry has increasingly explored memory-safe programming languages and stronger runtime protections.
For enormous mature projects such as Chromium, however, replacing decades of existing code is not something that happens overnight.
More Than 300 Fixes Makes This a Significant Chrome Update
The headline number is worth emphasising.
Chrome 152 addresses over 300 security vulnerabilities, with more than 10 categorised as critical in the source document.
Most users will never notice any visible difference after installing the update.
There may be no redesigned toolbar.
There may be no major new feature.
But from a security perspective, an update closing hundreds of vulnerabilities can be considerably more important than a release containing flashy interface changes.
Security updates often do their best work when users notice absolutely nothing.
Final Thoughts
Chrome 152 is an important security release, particularly because of the number and severity of the vulnerabilities being addressed.
Several critical flaws involve use-after-free bugs affecting important components such as ANGLE, Aura, Views and Safe Browsing, while the wider update fixes hundreds of additional issues across V8, WebGL, GPU, extensions, passwords and other browser systems.
Google has not confirmed active exploitation of the vulnerabilities, which is reassuring, but that should not become an excuse to postpone the update.
The fixed releases are Chrome 152.0.7977.64 on Linux and 152.0.7977.65 on Windows and macOS.
For most users, the action required is very simple:
Update Chrome, restart the browser and make sure the new version is actually running.
With a browser exposed to untrusted internet content every day, keeping it current remains one of the easiest and most effective security measures available.
Comments 0