Chrome Just Patched 26 Bugs — Two of Them Are Critical Memory Corruption

• The Mess: Google shipped Chrome 152.0.7977.75/.76 after finding 26 security flaws, including two Critical use-after-free vulnerabilities in Shared Tab Groups and WebGL.
• The Damage: A malicious webpage could potentially turn browser memory corruption into code execution, although Google has not reported active exploitation of these flaws.
• The Fix: Update Chrome to 152.0.7977.75 or later and make sure managed endpoints receive the new build.

Google just dropped another reminder that the browser is an enormous attack surface.

Chrome 152.0.7977.75/.76 fixes 26 security vulnerabilities across the desktop browser. The update is rolling out for Windows, macOS and Linux, with Chrome for Android receiving the corresponding security fixes as well.

Two vulnerabilities received Google’s Critical severity rating.

They are both use-after-free bugs.

Shared Tab Groups Got a Critical UAF

CVE-2026-84353 affects Chrome’s Shared Tab Groups component.

The vulnerability is a use-after-free condition, meaning Chrome can continue working with memory after that memory has already been released.

That’s exactly the kind of memory-management failure attackers like to find in browsers.

Chrome processes hostile content constantly.

A user does not need to download an executable or install an extension for browser attack surface to matter. A malicious webpage can be enough to trigger vulnerable browser code.

Google has kept technical details restricted while the update rolls out, so there is currently no public exploit information for this bug.

WebGL Has Another Critical UAF

CVE-2026-84352 hits WebGL.

That puts another memory-corruption bug inside a component that processes graphics content supplied by websites.

WebGL exists to let browsers render interactive 2D and 3D graphics using the GPU.

It also means more complicated native code is exposed to untrusted web content.

A successful memory-corruption exploit could potentially crash the browser, corrupt memory or become part of a larger browser exploit chain.

Again, Google has not reported active exploitation.

That’s an important distinction.

This is a critical vulnerability disclosure, not a confirmed zero-day campaign.

And There Are 24 More

The two Critical bugs are only the headline.

Chrome 152.0.7977.75/.76 also fixes numerous High- and Medium-severity vulnerabilities.

Among them are:

• CVE-2026-84354 — incorrect authorization in FileSystem
• CVE-2026-84359 — information leak in Skia
• CVE-2026-84357 — improper input validation in Omnibox
• CVE-2026-84324 — use-after-free in Proxy
• CVE-2026-84349 — use-after-free in Browser
• CVE-2026-84326 — uninitialized resource in V8
• CVE-2026-84333 — use-after-free in Dawn
• CVE-2026-84351 — GPU buffer overflow

Google’s release notes list all 26 security fixes and warn that access to detailed bug information can remain restricted until enough users have received the fixes.

That restriction is intentional.

Giving attackers technical exploitation details while a huge percentage of browsers are still vulnerable would be a spectacularly bad idea.

Why Browser Patching Still Matters

Chrome is not just a browser anymore.

It is where users open banking portals, cloud consoles, corporate dashboards, password managers, internal applications and administrative interfaces.

A browser compromise can therefore become the first stage of a much larger attack.

And memory corruption is particularly valuable to attackers because it can sometimes be chained with other vulnerabilities to escape browser sandboxes or reach the underlying operating system.

Google’s layered sandboxing makes that harder.

It does not make memory-corruption bugs irrelevant.

It makes exploitation more complicated.

Check the Version

The patched desktop builds are:

Windows/macOS: Chrome 152.0.7977.75/.76

Linux: Chrome 152.0.7977.75

Chrome for Android is also receiving version 152.0.7977.75 with the corresponding security fixes.

For normal users, opening Chrome’s About Chrome page should trigger the update.

For organizations, browser updates should be verified through endpoint-management systems rather than assumed to be installed simply because automatic updates are enabled.

Bugstoday Opinion

There is nothing glamorous about this patch.

No ransomware gang.

No stolen database.

No AI-powered hacker army.

Just 26 more ways for a browser to do something it absolutely shouldn’t.

The two Critical UAF bugs are the ones worth watching. Google is keeping the technical details locked down for now, which means defenders get a small advantage: patch first, investigate the exploit later.

That’s the right order.

Bugstoday verdict: A browser is an exposed attack surface with a URL bar. Treat every Critical memory bug like it matters before somebody proves it does.

Sources:

• Google Chrome Releases
• Chromium Security
• Google Chrome Security
• NVD
• CVE.org