- The Mess: Google just pushed Chrome 152 with fixes for 327 security vulnerabilities, including 10 Critical and 61 High-severity bugs. Most of the critical issues are memory-corruption flaws such as use-after-free vulnerabilities affecting ANGLE, Aura, Chromecast, Views and Safe Browsing.
That’s not a typo.
327.
Chrome’s latest security release is basically a small software graveyard.
The most interesting flaw is CVE-2026-79282, a Critical use-after-free in ANGLE, Chrome’s graphics translation layer. The researcher who found it received a $25,000 bounty from Google. Other critical bugs hit the browser UI, Chromecast, Views and Safe Browsing components.
And this isn’t just ten copies of the same bug.
The release contains memory-safety problems, input-validation failures, type confusion, buffer issues and other defects spread across different Chrome components.
Some are exactly the sort of bugs attackers love.
A malicious webpage.
A carefully constructed browser state.
Memory gets corrupted.
The browser crashes — or potentially something much worse happens.
Google has not reported any of these 327 vulnerabilities as exploited in the wild at the time of disclosure. That’s an important distinction.
This is a massive patch release.
It is not a confirmed mass exploitation campaign.
- The Damage: A successful browser exploit can potentially escape the intended security boundaries of Chrome and lead to information disclosure, browser compromise or arbitrary code execution, depending on the vulnerability and exploit chain.
And browsers are an unusually attractive target.
They process content controlled by strangers every time you open a website.
Ads.
JavaScript.
Images.
Fonts.
WebGL.
Video.
WebRTC.
Documents.
A browser is effectively a huge parser connected directly to the Internet.
Chrome’s sandbox is supposed to contain the damage when something goes wrong.
But attackers don’t generally care about one vulnerability in isolation.
A browser exploit chain can look like:
malicious webpage → renderer compromise → sandbox escape → operating system
That’s why a Critical Chrome memory bug deserves attention even when Google hasn’t confirmed exploitation.
There is another interesting detail here.
Google says 299 of the 327 vulnerabilities were discovered internally. Security researchers increasingly use automated analysis and AI-assisted tooling to find bugs at a scale that would have been difficult manually.
The result is slightly absurd.
Chrome keeps getting patched.
Then patched again.
Then patched again.
And the numbers keep climbing.
- The Fix: Update Chrome immediately to 152.0.7977.64 on Linux and 152.0.7977.64/.65 on Windows and macOS, then restart the browser.
Don’t assume Chrome will update itself eventually and forget about it.
Open:
Settings → About Chrome
and check the installed version.
The rollout is progressive, so some systems may receive the update later than others.
For organizations, check managed Chrome deployments as well.
A browser sitting open for weeks is not exactly helping.
And yes, Chrome’s automatic update mechanism is useful.
But “it should update eventually” isn’t a security strategy when the release fixes 10 Critical vulnerabilities.
Bugstoday Opinion
327 bugs.
Ten Critical.
That’s not a browser update.
That’s maintenance debt arriving with a baseball bat.
The reassuring part is that Google has not reported active exploitation of these Chrome 152 vulnerabilities. That’s good.
The less reassuring part?
Attackers don’t need every bug.
They need one.
And the Critical list contains exactly the sort of memory-corruption bugs that have historically been valuable for browser exploitation.
Chrome is probably the most exposed piece of software on many people’s computers because we deliberately feed it hostile content all day.
So don’t overthink this one.
Bugstoday verdict: update Chrome now. 327 patched vulnerabilities is already a big enough number. Ten of them being Critical is the part where “I’ll do it tomorrow” becomes a stupid security policy.
