Google has officially released Chrome 152 for Windows, macOS, and Linux. The stable channel update addresses an extraordinary 327 security vulnerabilities, 10 of which carry a Critical severity rating.
This massive security release is one of the most substantial in Chrome’s history, driven in large part by Google’s expanded use of AI-driven vulnerability discovery tools to surface memory-safety flaws internally.
The Critical Flaws: Memory Safety at Risk
Out of the 10 critical flaws patched in this update, 8 involve Use-After-Free (UAF) conditions. A UAF vulnerability occurs when software continues to reference a pointer after its allocated memory has been deallocated. In browser environments, an attacker can exploit UAF bugs to execute remote code, crash the browser, or bypass security sandboxes.
The highlight of the critical vulnerabilities is CVE-2026-79282, a use-after-free issue in ANGLE—Chrome’s graphics engine translation layer. Security researcher Goodluck reported the bug and earned a $25,000 bug bounty.
Breakdown of Critical Vulnerabilities in Chrome 152
| CVE ID | Vulnerability Type | Affected Component |
| CVE-2026-79282 | Use-after-free | ANGLE (Graphics Engine) |
| CVE-2026-79290 | Use-after-free | Aura (UI Framework) |
| CVE-2026-79054 | Use-after-free | Chromecast Integration |
| CVE-2026-79121 | Improper input validation | Chromecast Integration |
| CVE-2026-79224 | Use-after-free | Chromecast Integration |
| CVE-2026-79052 | Use-after-free | Aura (UI Framework) |
| CVE-2026-79150 | Use-after-free | Views (Layout System) |
| CVE-2026-78935 | Use of uninitialized variable | Chrome Mobile |
| CVE-2026-79012 | Use-after-free | Safe Browsing |
| CVE-2026-79200 | Use-after-free | Aura (UI Framework) |
High-Severity Risks Across Core Components
Beyond the critical tier, Chrome 152 includes 61 high-severity fixes spanning sensitive subsystems:
-
ANGLE & WebGL: Address buffer overflows and out-of-bounds reads/writes triggered by complex web graphics.
-
V8 JavaScript Engine: Mitigates type-confusion bugs that could allow malicious scripts to read or modify unintended memory locations.
-
WebRTC, Extensions & Autofill: Corrects race conditions, unauthorized data access, and input validation gaps.
Shift to a Faster Release Cadence
Alongside this massive patch haul, Chrome 152 marks a structural milestone for Google’s browser release cycle. Starting with version 153, Google is transitioning to a two-week Stable release cadence (shortened from four weeks) to deliver security patches and feature updates faster.
Immediate Action Required
Google has not reported any active zero-day exploitation of these bugs in the wild. However, technical details are temporarily restricted to protect users until the update reaches mass adoption.
To update your browser immediately:
-
Open Chrome and click the three-dot menu in the upper right corner.
-
Navigate to Help > About Google Chrome.
-
Allow the browser to download the build (152.0.7977.64 for Linux, 152.0.7977.64/.65 for Windows and macOS).
-
Click Relaunch to finalize protection.
