Google's Chrome 152 stable channel release fixes 327 security issues in total, ten of which are rated Critical: CVE-2026-79282, CVE-2026-79290, CVE-2026-79054, CVE-2026-79121, CVE-2026-79224, CVE-2026-79052, CVE-2026-79150, CVE-2026-78935, CVE-2026-79012, CVE-2026-79200. Most are use-after-free memory-safety flaws in components including ANGLE (graphics rendering), Aura (window/UI compositing), Chromecast, Views (the UI framework), and Safebrowsing, alongside one critical use-of-uninitialized-variable bug in the Mobile component.

These are memory-corruption bugs that, if triggered by malicious or compromised web content, can potentially be leveraged by an attacker to execute arbitrary code within the browser. The release also addresses roughly 60 further High-severity issues and over 200 Medium- and Low-severity issues; because Chrome ships all fixes in a single build, the same update resolves all of them regardless of severity tier.

The following version(s) are affected:

Google Chrome prior to 152.0.7977.64 (Linux) – (Affected)
Google Chrome prior to 152.0.7977.64/.65 (Windows and Mac) – (Affected)
Google Chrome 152.0.7977.64/.65 and later – (Not affected, patched)

Chrome usually updates itself automatically in the background, but the fix only takes effect after the browser is restarted. Users and administrators should not assume they are protected until they have confirmed the version and restarted the browser.

Most of these flaws require no more than normal web browsing to trigger.

Step 1 - Trigger the Memory-Safety Flaw

A user visits a malicious or compromised website, or interacts with a malicious Chromecast device or session, causing Chrome to reach a use-after-free or uninitialized-variable condition in one of the affected components.

Step 2 - Exploit the Resulting Memory Corruption

The attacker leverages the corrupted memory state to execute arbitrary code within the browser process, with the potential to chain further bugs to escape Chrome's sandbox depending on the specific component involved.

Attack Vectors

• Visiting a malicious or compromised website - no special user action beyond normal browsing is required for most of these flaws.
• Interacting with a malicious Chromecast device or casting session, for the Chromecast-specific flaws.

Potential Impact

• Execute arbitrary code within the browser process, or crash the browser (denial of service).
• Potentially compromise the host further if a browser exploit is chained with a separate sandbox-escape vulnerability.

CERTVU recommends the following:

1. Update Chrome and restart the browser

   Confirm Chrome has updated to 152.0.7977.64 or later (152.0.7977.65 on Windows/Mac) via chrome://settings/help, then fully restart the browser so the update takes effect.

2. Push the update fleet-wide in managed environments

   Administrators managing Chrome via policy should confirm the update has been deployed and browsers restarted across all managed devices, rather than relying on individual users to do so.

3. Enable automatic updates

   Ensure Chrome's automatic update mechanism is enabled and not blocked by local policy or network restrictions, so future security fixes are applied promptly.

4. Audit the estate for outdated browsers

   Identify any devices still running a pre-152.0.7977.64/.65 version of Chrome and prioritise them for update and restart.

5. Monitor Google's Chrome Releases blog for further updates

   Keep track of subsequent stable channel updates, as Chrome issues frequent releases in response to newly discovered vulnerabilities.

For further detail, see Google Chrome Releases: Stable Channel Update for Desktop.