Google has released the Chrome 152 security update for Windows, macOS, and Linux, delivering 327 security fixes, including 10 vulnerabilities rated Critical.
The Stable release is rolling out as Chrome 152.0.7977.64 for Linux and 152.0.7977.64/.65 for Windows and macOS. Google says the rollout will continue over the coming days and weeks.
For most users, the immediate action is simple: check for the latest Chrome update, install it, and relaunch the browser so the patched version is actually running.
For IT and security teams, there is one more step: verify that managed endpoints have completed the update rather than merely downloaded it.
One clarification is important from the start. Google's 327 figure refers to security fixes. It should not be interpreted as 327 fully public CVEs with unrestricted technical details. Google notes that access to bug details may remain restricted until a majority of users have received the fixes, and restrictions can remain longer when a bug affects shared third-party code.
Key Findings
- Chrome 152 Stable began rolling out on August 25, 2026.
- Google says the release contains 327 security fixes.
- 10 vulnerabilities are rated Critical.
- Based on the vulnerability types listed in the release, eight of those ten Critical issues are use-after-free flaws.
- Critical vulnerabilities affect components including ANGLE, Aura, Chromecast, Views, Safe Browsing, and Mobile.
- NVD currently describes CVE-2026-79282 as a Critical ANGLE use-after-free flaw affecting Chrome on Android before 152.0.7977.65, with potential code execution outside the sandbox through crafted HTML.
- NVD describes CVE-2026-79012 as a Critical Safe Browsing use-after-free issue affecting Chrome on macOS before 152.0.7977.65.
- In the release information reviewed for this article, Google did not identify any of the listed Chrome 152 fixes as being exploited in the wild. That should not be interpreted as proof that exploitation does not exist or cannot emerge later.
- Chrome updates may remain pending until the browser is relaunched.
What the Chrome 152 Security Update Fixes
Chrome 152 is not addressing one isolated bug. The security release covers vulnerabilities across multiple parts of the browser.
Modern browsers contain a large collection of security-sensitive components: graphics processing, rendering, JavaScript execution, browser UI, media handling, Safe Browsing, networking, sandboxing, extensions, authentication, and more.
A weakness in one component may create a very different risk from a weakness in another. That is why the severity label alone does not tell the entire story.
The release includes 327 security fixes, but Google is not exposing unrestricted technical information for every bug immediately. Limiting early access to vulnerability details is a normal defensive measure while patches are still reaching users and downstream projects.
For broader background on recurring browser flaws, Hoplon Infosec's Google Chrome vulnerabilities guide explains common vulnerability classes and browser attack surfaces.
The 10 Critical Chrome 152 Vulnerabilities
The Chrome 152 release identifies ten Critical vulnerabilities across six component areas.
|
CVE |
Vulnerability Type |
Component |
|
CVE-2026-79282 |
Use-after-free |
ANGLE |
|
CVE-2026-79290 |
Use-after-free |
Aura |
|
CVE-2026-79054 |
Use-after-free |
Chromecast |
|
CVE-2026-79121 |
Improper input validation |
Chromecast |
|
CVE-2026-79224 |
Use-after-free |
Chromecast |
|
CVE-2026-79052 |
Use-after-free |
Aura |
|
CVE-2026-79150 |
Use-after-free |
Views |
|
CVE-2026-78935 |
Use of uninitialized variable |
Mobile |
|
CVE-2026-79012 |
Use-after-free |
Safe Browsing |
|
CVE-2026-79200 |
Use-after-free |
Aura |
The list is based on Google's Chrome 152 security release information and current CVE reporting.
The concentration of use-after-free bugs is notable, but these vulnerabilities should not all be treated as technically identical. Platform exposure, exploit prerequisites, affected components, and documented impact vary by CVE.
CVE-2026-79282: Critical ANGLE Use-After-Free
CVE-2026-79282 is one of the most prominent externally reported Critical vulnerabilities in the release.
ANGLE is part of Chrome's graphics stack. It helps translate graphics API calls across different platforms and graphics backends.
NVD currently describes the vulnerability as a use-after-free issue in ANGLE affecting Chrome on Android prior to 152.0.7977.65. According to the CVE description, a remote attacker could execute arbitrary code outside the sandbox through a crafted HTML page in the affected configuration.
This platform detail matters. The existence of CVE-2026-79282 in the Chrome 152 security release should not be used to claim that every desktop Chrome installation has the exact impact described in the Android CVE record.
Google's release information also associates a $25,000 security reward with this finding.
Other Critical Components
Several other Critical vulnerabilities affect Aura and Chromecast.
Aura has three listed Critical use-after-free bugs:
- CVE-2026-79290
- CVE-2026-79052
- CVE-2026-79200
Chromecast has two Critical use-after-free issues plus one improper input-validation flaw.
Views contains CVE-2026-79150, another Critical use-after-free issue.
Safe Browsing contains CVE-2026-79012. NVD currently states that the flaw affected Chrome on macOS prior to 152.0.7977.65 and could allow a remote attacker using social engineering to execute arbitrary code outside the sandbox through crafted HTML.
CVE-2026-78935 is different from most of the Critical group because it involves the use of an uninitialized variable in a Mobile component rather than a use-after-free condition.
Readers interested in the difference between browser vulnerabilities and documented arbitrary code execution can also see Hoplon's Chrome arbitrary code execution explainer.
Why Use-After-Free Bugs Matter
A use-after-free vulnerability is a memory-management error.
Software allocates memory while it is running. When an object is no longer required, its memory can be released and reused.
The problem occurs when part of the program still holds a reference to that released memory.
A simplified sequence looks like this:
- Chrome creates an object in memory.
- The object is destroyed and its memory is released.
- A stale reference to that memory remains.
- The released memory may later be reused.
- Chrome accesses the stale reference.
- Under certain conditions, an attacker may influence what now occupies that memory.
The immediate result could be a crash or memory corruption. In some vulnerabilities, carefully controlled memory corruption can create more serious consequences, including code execution.
But use-after-free does not automatically mean remote code execution.
The actual impact depends on the individual vulnerability, affected platform, browser defenses, user interaction requirements, and whether another vulnerability must be chained with it.
That distinction is especially important when reading security headlines.
Are the Chrome 152 Flaws Actively Exploited?
Google's Chrome 152 release information reviewed for this article did not identify any of the listed vulnerabilities as exploited in the wild.
That wording is deliberate.
It means the release note did not carry an active-exploitation warning for these fixes at the time of review. It does not establish that exploitation is impossible, that no attacker is researching the flaws, or that exploit status cannot change after publication.
This is different from a confirmed Chrome zero-day, where Google explicitly reports evidence that an exploit exists in the wild.
For comparison, Hoplon Infosec's coverage of CVE-2026-11645 discusses a Chrome vulnerability that Google had identified as actively exploited.
Security teams should therefore continue monitoring current vendor and CVE information even after deploying Chrome 152.
Chrome 152 Patched Versions for Desktop
For the Stable desktop release announced on August 25, 2026:
|
Platform |
Chrome 152 Stable Build |
|
Windows |
152.0.7977.64/.65 |
|
macOS |
152.0.7977.64/.65 |
|
Linux |
152.0.7977.64 |
Google says the update is rolling out over the coming days and weeks.
These version numbers are a point-in-time reference, not a permanent "safe version." If Google publishes a newer Stable security build, users should move to the newer supported build instead of trying to remain on these exact versions.
What About Android and iOS?
Mobile Chrome follows a separate distribution process, so users should not assume that desktop and mobile build numbers or rollout timing will always match.
Google's official Android guidance says Chrome updates are delivered through Google Play according to the device's Play Store update settings. Users can manually check under Manage apps & device and update Chrome when a new build is available.
For mobile devices, the practical recommendation is therefore to check the relevant app store and install the latest Chrome version available for that device.
Should You Install Chrome 152 Now?
Yes. Users running an affected older version should install the current Stable Chrome update when it becomes available and relaunch the browser.
That recommendation does not depend on claiming that the vulnerabilities are already under attack.
Google has already issued fixes for multiple Critical security weaknesses. Continuing to use an affected older build adds avoidable exposure.
Chrome normally updates in the background, but Google explains that an update can remain pending if the browser has not been closed for some time. The update applies when Chrome is relaunched.
That creates an important distinction:
A downloaded patch is not the same as a patched browser that is currently running.
How to Update Chrome and Verify the Version
Google's desktop update process is straightforward:
- Open Google Chrome.
- Select the three-dot More menu.
- Go to Help → About Google Chrome.
- Chrome checks for available updates.
- If an update is pending, allow it to install.
- Select Relaunch.
- Return to About Google Chrome and confirm the running version.
Google notes that if you choose not to restart immediately, the update will apply the next time Chrome restarts.
For users who want Google's own instructions, see Update Google Chrome.
Hoplon has also covered similar browser patching issues in its Chrome 148 security update analysis.
What IT and Security Teams Should Do
For a company managing hundreds or thousands of browsers, sending an update is only part of the job.
A more reliable process is:
Check → Patch → Relaunch → Verify → Monitor
This is a practical remediation framework, not an official Google framework.
Check
Identify which Chrome versions are running across managed devices.
The goal is to find endpoints that are behind the current approved security baseline rather than assuming automatic updates have completed everywhere.
Patch
Deploy the approved current Stable release according to your organization's change and update process.
High-risk browser vulnerabilities usually justify prompt remediation because browsers continuously process content from external websites.
Relaunch
A Chrome process that remains open can continue running an older version even after an update has been downloaded.
Google provides enterprise policies specifically for pending browser updates. Administrators can recommend a relaunch or require users to relaunch within a defined time window. These policies apply to managed Chrome browsers on Windows, macOS, and Linux.
See Google's pending-update relaunch guidance for the available policy controls.
Verify
After deployment, confirm that the intended version is actually running.
Pay particular attention to:
- endpoints still running older builds;
- devices with pending updates;
- systems that have not checked in recently;
- users who have postponed a browser relaunch;
- policy or deployment exceptions.
This step is what separates a patch deployment from verified remediation.
Organizations that need a broader process for finding, prioritizing, and tracking security weaknesses can connect browser patching to a structured Vulnerability Management program.
Monitor
Continue monitoring vendor security advisories and CVE records after deployment.
A vulnerability disclosed without an active-exploitation warning can receive new technical information later. Exploit availability, affected configurations, severity scoring, and defensive guidance can all change after initial disclosure.
Do Other Chromium-Based Browsers Need Attention?
Potentially, yes, when a vulnerability affects shared Chromium code. But a Chrome security update does not automatically update another browser.
Google's Chrome for Developers documentation confirms that Chromium's codebase is also used by browsers including Microsoft Edge, Brave, Opera, Vivaldi, Arc, and others.
That does not mean every Chrome CVE automatically affects every Chromium-based browser in the same way.
Each browser vendor can:
- modify Chromium code;
- ship different components;
- integrate fixes on a different schedule;
- publish a separate browser version.
If your organization uses Edge, Brave, Opera, Vivaldi, or another Chromium-based product, check that vendor's own security and release information rather than assuming the Chrome 152 update covers it.
Why This Update Matters for Businesses
Browsers are exposed to untrusted internet content while employees use them to access email, SaaS applications, identity providers, internal systems, cloud consoles, and other valuable resources.
That makes browser patching part of endpoint risk management, not just routine application maintenance.
For an IT manager or CISO, the useful question is not simply:
"Did Google release a patch?"
It is:
"Can we verify that our endpoints are actually running the patched browser?"
Organizations with weak endpoint inventory, inconsistent update enforcement, or limited visibility into pending browser patches may need to address the underlying management gap rather than treating each Chrome advisory as a separate event.
Hoplon Infosec's Endpoint Security Protection Services are relevant where organizations need broader endpoint-security controls and visibility.
Chrome 152 Security Update: What to Do Now
For an individual user, the priority is to update Chrome, relaunch it, and verify the installed version.
For an IT team, the response should go one step further: identify outdated endpoints, deploy the update, enforce or encourage relaunch where appropriate, verify the running build, and monitor the Critical CVEs for new information.
Chrome 152's 327 security fixes make this a substantial security release, but the number itself should not be sensationalized. The more important questions are which vulnerabilities affect your environment and whether the patched browser is actually running.
When Browser Patching Reveals a Larger Security Gap
A Chrome update is easy to install on one laptop. The harder problem is proving that every relevant endpoint in an organization has received and activated the fix.
If your team cannot quickly answer which devices are outdated, which patches remain pending, or which vulnerabilities should be prioritized first, the problem extends beyond Chrome.
A structured vulnerability-management program can help organizations identify weaknesses, prioritize remediation, track patch status, and verify that corrective work has actually been completed.
Hoplon Infosec provides Vulnerability Management services for organizations that need a more systematic approach to vulnerability identification and remediation.
For organizations looking for broader device-level monitoring and protection, Hoplon also provides Endpoint Security Protection Services.
The appropriate next step depends on your environment, existing controls, endpoint inventory, and internal security capabilities. No service can guarantee that every cyberattack will be prevented.
Primary and Authoritative Sources
- Google Chrome Releases - Stable Channel Update for Desktop
- Google Chrome Help - Update Google Chrome
- Chrome Enterprise - Pending Update Relaunch Policies
- NVD - CVE-2026-79282
