Google Chrome Patches 26 Vulnerabilities, Including Two Critical Use-After-Free Flaws
Google has released an update for Chrome, addressing 26 security vulnerabilities, with two critical use-after-free flaws in Shared Tab Groups and WebGL posing the most significant risk.
Google has rolled out an update for its Chrome browser, version 152.0.7977.75/.76 for Windows and macOS, and 152.0.7977.75 for Linux, to address a total of 26 security vulnerabilities. Among these, two critical use-after-free flaws have been identified, making it imperative for both individual users and enterprises to install the update promptly. The stable channel update is being distributed gradually over the coming days and weeks.
While Google has not yet confirmed if any of these vulnerabilities are being actively exploited in the wild, the presence of critical memory-safety issues means that attackers could potentially leverage specially crafted web content to cause Chrome to crash or gain control of the browser process. This underscores the importance of timely patching to mitigate potential risks.
The two critical vulnerabilities are designated as CVE-2026-84353 and CVE-2026-84352. CVE-2026-84353 is a use-after-free vulnerability specifically affecting the Shared Tab Groups feature. Concurrently, CVE-2026-84352 impacts WebGL, Chrome's technology for rendering interactive 2D and 3D graphics. A use-after-free bug occurs when a program attempts to access memory that has already been deallocated, which can lead to memory corruption, browser crashes, information disclosure, or even remote code execution if an attacker can manipulate the affected memory.
Vulnerabilities within WebGL are particularly concerning due to their potential to be triggered through web applications, advertisements, or malicious websites that utilize graphics-related browser functions. This broad attack surface increases the likelihood of exploitation.
In addition to the critical flaws, Google has also resolved several high-severity vulnerabilities. These include an incorrect authorization flaw in the FileSystem component (CVE-2026-84354), an information leak in Skia (CVE-2026-84359), and an improper input validation bug in the Omnibox component (CVE-2026-84357). Other high-severity issues patched involve use-after-free vulnerabilities in Proxy, Browser, and Dawn, tracked as CVE-2026-84324, CVE-2026-84349, and CVE-2026-84333, respectively. An uninitialized resource issue in the V8 JavaScript engine (CVE-2026-84326) and a GPU buffer overflow vulnerability (CVE-2026-84351) were also addressed.
The update also includes fixes for a range of medium- and low-severity issues affecting various components such as WebRTC, Downloads, Navigation, SiteSettings, FullScreen, Chromoting, MediaCapture, TabStrip, Autofill, CredentialProvider, and Actor. Several authorization issues within the FileSystem component were also patched.
Google typically restricts access to detailed bug reports and technical information until a majority of users have applied the update. This practice is designed to prevent attackers from weaponizing publicly available vulnerability data before systems are adequately protected. The company acknowledged contributions from internal teams and external security researchers for identifying these vulnerabilities during the development cycle, utilizing advanced security testing technologies like AddressSanitizer and libFuzzer.
Users can initiate an update by opening Chrome, navigating to Settings, selecting 'About Chrome,' and allowing the browser to download and install the latest version. Organizations are advised to ensure that their managed endpoints receive and apply Chrome 152.0.7977.75 or a later version as the rollout progresses to maintain a secure browsing environment.
Mozilla has also released updates for Firefox and Thunderbird, addressing a total of 29 security defects. These include critical use-after-free, sandbox escape, and memory corruption issues across various components, as well as in Firefox for Android. Extended Support Release (ESR) versions of Firefox and Thunderbird have also been patched.