Loading story…
Google released Chrome 152 for Windows, macOS, and Linux with fixes for 327 vulnerabilities, including 18 rated critical and 53 rated high severity. Affected desktop versions are 152.0.7977.64/.65 for Windows and macOS and 152.0.7977.64 for Linux. The fixes address arbitrary-code-execution, security-bypass, and information-disclosure risks; Google has restricted access to some bug details while users deploy the update and reports no known active exploitation.
The most significant fixes include CVE-2026-79282, a use-after-free flaw in ANGLE that a malicious HTML page could exploit to execute code outside Chrome's browser sandbox, and CVE-2026-78899, a V8 use-after-free vulnerability rated CVSS 8.8 that could enable code execution within the sandbox. Organizations should urgently update managed Chrome installations and require browser restarts, as both flaws are reachable through malicious websites and could be combined in exploit chains.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Chrome 152 added bypassable warnings for Safe Browsing Enhanced Protection users when Chrome detects signals that a visited site may be malicious. Confirmed-malicious-site interstitials remain in place, and administrators can manage the new warnings through Safe Browsing enterprise policies.
Google released Chrome 152 for Windows, macOS, and Linux, updating desktop stable-channel builds to 152.0.7977.64/.65 on Windows and macOS and 152.0.7977.64 on Linux. The release addresses 327 vulnerabilities, including critical issues such as CVE-2026-79282 in ANGLE and CVE-2026-78899 in V8; Google said it was unaware of active exploitation of the fixed flaws.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
9 references tracked. Mallory keeps watching after this page renders.
opennet.me
Open sourceopennet.ru
Open sourcemalware.news
Open sourcemalwarebytes.com
Open sourceacn.gov.it
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourcechromereleases.googleblog.com
Open sourcedeveloper.chrome.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released Chrome 152.0.7977.75/.76 for Windows and macOS and 152.0.7977.75 for Linux, patching 26 vulnerabilities. The fixes include critical use-after-free flaws in Shared Tab Groups (`CVE-2026-84353`) and WebGL (`CVE-2026-84352`), which could allow malicious web content to crash the browser, disclose information, or potentially execute code in the browser process. The release also addresses nine high-severity issues and additional flaws affecting FileSystem, Skia, Omnibox, V8, GPU, WebRTC, Downloads, and TabStrip, including risks of code execution and security-control bypass. Google has not reported active exploitation; organizations should verify managed endpoints update to Chrome 152.0.7977.75 or later as the Stable-channel rollout progresses.
Sep 5, 2026
Google has released a major Chrome security update fixing **382 vulnerabilities** across Windows, macOS, Linux, iOS, and Android, including **15 critical** and **67 high-severity** flaws. The patched bugs span components such as **Extensions, GPU, WebUSB, Browser, Bluetooth, Chromoting, Ozone, Dawn/WebGPU, ANGLE, Skia, Views, Fullscreen, and iOSWeb**, with many involving `use-after-free`, `type confusion`, out-of-bounds access, uninitialized use, and insufficient validation of untrusted input. Google said **358** of the issues were found internally through tooling and fuzzing, while others were reported by external researchers. Several of the vulnerabilities could be triggered through crafted web content to achieve renderer compromise, heap corruption, control-flow hijacking, and in some cases **sandbox escape** leading to code execution on the underlying system. Reported examples include **CVE-2026-13789**, a high-severity `use-after-free` flaw in the GPU component that could enable a remote attacker with renderer access to escape the sandbox, along with critical issues such as **CVE-2026-13774**, **CVE-2026-13775**, **CVE-2026-13776**, **CVE-2026-13778**, **CVE-2026-13782**, **CVE-2026-13785**, and **CVE-2026-13788**. Google said it had **no evidence of in-the-wild exploitation** at release, but urged rapid deployment of the update, particularly in enterprise environments and for Chromium-based browsers.
Jul 12, 2026
Google has released a Chrome desktop stable-channel update to address 15 security issues, including two **critical** buffer overflow vulnerabilities that could let a remote attacker achieve arbitrary code execution outside the browser sandbox through a crafted HTML page. The flaws are tracked as `CVE-2026-76034` in **WebGL** and `CVE-2026-76036` in **Dawn**, the graphics library that implements the **WebGPU** standard, raising the risk that a user could be compromised simply by visiting a malicious or compromised website. The update brings Chrome to version **151.0.7922.169/.170** on Windows and macOS and **151.0.7922.169** on Linux. The patched vulnerabilities affect desktop Chrome across all three platforms, and the presence of sandbox-escape-capable browser bugs makes the release particularly urgent because successful exploitation could move execution from browser content directly onto the host system.
Aug 19, 2026