Chromium: 12 Vulnerabilities Including High-Severity Flaws Disclosed Together on September 2, 2026

Key findings

• 12 vulnerabilities disclosed simultaneously for Google Chrome on September 2, 2026.
• High-severity flaws include improper input validation, buffer overflows, and use-after-free bugs.
• Multiple medium-severity incorrect authorization vulnerabilities could lead to policy bypasses.
• Update to Chrome 152.0.7977.75 is required to patch these issues.
• Vulnerabilities affect various components including Omnibox, GPU, FileSystem, and TabStrip.

On September 2, 2026, Google released Chrome version 152.0.7977.75 to address a batch of 12 vulnerabilities, including several high-severity flaws. These vulnerabilities span various components of the browser, with incorrect authorization and use-after-free bugs being prominent. The timely patching of these issues is crucial for users to protect against potential exploitation, which could lead to arbitrary code execution or policy bypasses.

Several vulnerabilities stem from incorrect authorization flaws. CVE-2026-84355, CVE-2026-84335, and CVE-2026-84332, all rated medium severity, involve incorrect authorization in areas such as Navigation, TabStrip, and SiteSettings, respectively. These could allow remote attackers to bypass web origin policies or system access restrictions. Additionally, CVE-2026-84334, a medium-severity flaw on Windows, permits a local attacker to execute arbitrary code outside the sandbox via a local program. CVE-2026-84328, a medium-severity missing authorization vulnerability in FileSystem, also poses a risk.

High-severity vulnerabilities include improper input validation in the Omnibox component, detailed in CVE-2026-84357, which could allow a remote attacker to bypass web origin policy through social engineering and crafted network traffic. CVE-2026-84354, another high-severity flaw in FileSystem, allows a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page, potentially by leveraging social engineering. A buffer overflow in the GPU component, CVE-2026-84351, also carries a high severity rating and could lead to arbitrary code execution on Windows. Furthermore, CVE-2026-84349, a high-severity use-after-free vulnerability in the Browser component, allows remote attackers to execute arbitrary code via a crafted HTML page after compromising the renderer process.

Medium-severity issues also present significant risks. CVE-2026-84348 describes an information leak in MediaCapture, allowing remote attackers to potentially access sensitive information via a crafted HTML page. CVE-2026-84355, a medium-severity incorrect authorization flaw in Navigation, could allow a remote attacker who had compromised the renderer process to bypass web origin policy.

The update to Chrome 152.0.7977.75 addresses all these vulnerabilities. While the provided information does not indicate active exploitation in the wild for this specific batch, the nature of memory-safety vulnerabilities like use-after-free and buffer overflows means that attackers could potentially leverage specially crafted web content to crash Chrome or gain control within the browser process. Users are strongly advised to update to the latest version to mitigate these risks.

The batch of vulnerabilities was disclosed on September 2, 2026, with all CVEs published simultaneously. The affected versions are prior to 152.0.7977.75. The update, Chrome 152.0.7977.75, is rolling out gradually. Users should ensure their browsers are updated to the latest stable version to benefit from these security enhancements.

This coordinated disclosure highlights the ongoing efforts to secure the Chromium browser. Users should remain vigilant and apply updates promptly, as vulnerabilities in widely used software like Chrome can be attractive targets for malicious actors. Staying informed about security advisories and applying patches is a critical step in maintaining a secure browsing experience.