overview
Google has released Chrome 152 with 327 security fixes, including 10 critical vulnerabilities affecting multiple browser components. The critical flaws are primarily memory-safety issues, including use-after-free vulnerabilities in ANGLE (graphics translation layer), Aura (UI framework), Chromecast, Views, Safe Browsing, and Mobile components.
While Google reports no active exploitation of these vulnerabilities in the wild, the large volume of critical fixes and use-after-free bugs that could potentially enable remote code execution makes immediate patching essential for all organizations and users. Chrome 152 is rolling out over the coming days and weeks as version 152.0.7977.64 for Linux and 152.0.7977.64/.65 for Windows and macOS. This notice explains the vulnerabilities, potential impact, and recommended patching procedures.
vulnerability overview and technical details
Critical Vulnerabilities (10 Total):
The 10 critical vulnerabilities addressed in Chrome 152 are predominantly use-after-free conditions and related memory-safety flaws. Use-after-free vulnerabilities occur when software continues to access memory after it has been released, potentially allowing attackers to crash the browser, leak sensitive information, or execute arbitrary code.
CVE-2026-79282 – Use-After-Free in ANGLE (Graphics Translation Layer)
- ANGLE is Chrome's graphics translation layer that processes graphics-related content including WebGL and GPU acceleration
- Attackers could potentially craft malicious web pages with specially crafted graphics or WebGL data to trigger the use-after-free condition
- Researcher reward: $25,000 (reported by Goodluck)
- Impact: Remote code execution on affected Chrome process, browser crash, information disclosure
CVE-2026-79290, CVE-2026-79052, CVE-2026-79200 – Use-After-Free in Aura (UI Framework)
- Aura is Chrome's user-interface framework that handles UI element rendering and interaction
- Three separate use-after-free conditions in Aura could allow attackers to corrupt memory and execute code
- Impact: Remote code execution, denial of service, information disclosure
CVE-2026-79054, CVE-2026-79224 – Use-After-Free in Chromecast
- Chromecast integration in Chrome enables casting to Chromecast-enabled devices
- Two use-after-free flaws could be exploited via specially crafted Chromecast payloads or device interactions
- Impact: Remote code execution, browser crash
CVE-2026-79121 – Improper Input Validation in Chromecast
- Insufficient validation of Chromecast input could allow attackers to bypass security checks
- Impact: Privilege escalation, unauthorized Chromecast access, data manipulation
CVE-2026-79150 – Use-After-Free in Views (Chrome UI Components)
- Views is Chrome's framework for rendering UI components (buttons, menus, dialogs)
- Use-after-free in Views could be triggered by specific UI interactions or malicious web pages
- Impact: Remote code execution, browser crash
CVE-2026-78935 – Uninitialized Variable in Mobile (Chrome Mobile)
- Uninitialized variables can lead to unpredictable behavior and potential security flaws
- Mobile component vulnerability suggests risk specifically on mobile Chrome deployments
- Impact: Information disclosure, denial of service
CVE-2026-79012 – Use-After-Free in Safe Browsing
- Safe Browsing is Chrome's malware and phishing detection system
- Use-after-free in Safe Browsing could allow attackers to bypass malware detection or crash the service
- Impact: Remote code execution, bypass of security protections
High-Severity Vulnerabilities (317 Additional Fixes):
Chrome 152 also addresses 317 high-severity vulnerabilities, including:
- Buffer overflows and out-of-bounds reads/writes in ANGLE (multiple), allowing memory corruption
- Type confusion errors that could enable privilege escalation or code execution
- Race conditions in WebRTC, GPU, and threading components
- Information leaks through Autofill, Passwords, and Bluetooth subsystems
- Authorization flaws in Extensions framework
- Sandbox escapes and privilege escalation conditions
Affected Components:
ANGLE, Aura, Chromecast, Views, Safe Browsing, Mobile, WebGL, V8, WebRTC, Extensions, Autofill, GPU, Bluetooth, Sandbox, Passwords, and other browser subsystems.
exploitation status
As of August 26, 2026, Google has not reported any active exploitation of Chrome 152 vulnerabilities in the wild. However, Google is restricting detailed vulnerability information and links to exploit details until most users have updated, which suggests potential exploitation risk.
Google may also restrict information when flaws in third-party libraries (such as ANGLE) have not yet been patched in other dependent projects, potentially affecting other browser vendors or applications that use ANGLE.
potential impact
- Remote Code Execution: Use-after-free and memory corruption vulnerabilities could allow attackers to execute arbitrary code within Chrome process context, potentially compromising user systems.
- Browser Crash and Denial of Service: Malformed inputs targeting graphics (WebGL), UI rendering, or other components could crash Chrome, disrupting business operations and remote work productivity.
- Information Disclosure: Memory corruption or Safe Browsing vulnerabilities could leak sensitive information including browsing history, credentials, authentication tokens, or cached data.
- Credential and Session Theft: Uninitialized variables or information leaks could expose credentials stored in Autofill, authentication tokens for business applications (M365, Salesforce, VPN), or active session cookies.
- Security Control Bypass: Safe Browsing vulnerabilities could allow attackers to bypass malware and phishing detection, enabling distribution of malware through Chrome users.
- Privilege Escalation: Sandbox escape or authorization bypass flaws could allow attackers to escape Chrome's sandbox and gain elevated privileges on the underlying operating system.
- Lateral Movement: Compromised Chrome process with RCE could be used as entry point for lateral movement into corporate networks (if used for accessing internal applications or VPN).
- Device Compromise (Mobile): Mobile-specific vulnerabilities could compromise Android or iOS devices used for corporate access, email, and sensitive applications.
- VPN and Remote Access Risk: Many remote workers use Chrome to access VPN clients, corporate portals, and cloud applications. Chrome RCE could enable attackers to compromise VPN sessions or intercept remote access credentials.
indicators of compromise
Endpoint Indicators:
- Chrome process crashes or unexpected terminations (especially during graphics rendering or WebGL-heavy sites)
- Unexpected Chrome child processes or code injection into Chrome (sign of memory corruption exploitation)
- Unusual outbound network connections from Chrome process to unknown IP addresses
- Elevated privilege attempts originating from Chrome process (sandbreak exploitation)
- Suspicious files or binaries created in user's Chrome profile directory (e.g., /AppData/Local/Google/Chrome/User Data/)
- Chrome version stuck below 152.0.7977.64/65 despite update attempts
Network Indicators:
- Connections to known malware command-and-control (C&C) infrastructure from Chrome process
- Large data exfiltration from affected systems following Chrome update delay
- VPN or remote access session hijacking attempts following Chrome compromise
User Behavior Indicators:
- Employee reports of browser crashes during specific tasks or website visits
- Unexpected password resets or MFA failures on business accounts (sign of credential theft)
- Reports of unauthorized access or activity from employee devices
monitoring and telemetry
- Endpoint Detection and Response (EDR): Monitor Chrome process (chrome.exe or Google Chrome on macOS/Linux) for suspicious activity: code injection, network connections, privilege escalation, file access patterns.
- Chrome Update Monitoring: Track Chrome version across all managed endpoints. Alert on systems running versions below 152.0.7977.64/65, or where auto-update has been disabled.
- Process Crash Monitoring: Alert on unexpected Chrome crashes or high crash frequency (potential sign of exploitation attempts against unpatched instances).
- Browser Extension Monitoring: Monitor for unauthorized or suspicious Chrome extensions installed (potential malware delivery vector post-compromise).
- Network Traffic Analysis: Monitor for unusual outbound connections from Chrome process, especially to known malware infrastructure or suspicious domains.
- VPN Session Monitoring: If users access VPN through Chrome, monitor for impossible travel patterns or session anomalies (sign of VPN credential theft).
- Authentication Monitoring: Alert on failed authentication attempts using credentials that may have been exposed through Chrome compromise (especially M365, Salesforce, internal applications).
- Threat Intelligence Integration: Subscribe to threat feeds tracking Chrome vulnerability exploitation. Monitor for new PoC releases or active campaigns targeting Chrome 151 or earlier versions.
compliance impact
Successful exploitation of Chrome vulnerabilities and compromise of business-critical systems has compliance implications:
PCI DSS (Payment Card Industry):
- Requirement 6.2: Security patches – failure to patch Chrome vulnerable versions violates patch management requirements
- Requirement 8: Authentication – credential theft via Chrome compromise violates authentication controls
- Requirement 10: Logging and monitoring – failure to detect Chrome-based attacks indicates monitoring gaps
HIPAA (Health Insurance Portability and Accountability Act):
- Access Control safeguard – Chrome compromise enabling unauthorized access to PHI violates access controls
- Audit Controls – Chrome-based data access must be logged and monitored
- Encryption – cached healthcare data in Chrome must be protected
SOX (Sarbanes-Oxley Act):
- Section 302: CEO/CFO certification – system compromise affects integrity of financial and operational systems
- Section 404: Internal control assessment – failure to patch indicates control failures
GDPR (General Data Protection Regulation):
- Article 32: Security of Processing – unpatched Chrome violates technical security measures
- Article 33: Breach Notification – personal data exposure via Chrome compromise requires breach notification
ISO/IEC 27001:
- A.12: Operations security – patch management and system hardening required
- A.13: Communications security – protection of systems accessing sensitive data
NIST Cybersecurity Framework (CSF):
- Protect (PR.MA) – Maintenance and updates – patch all systems within defined SLA
- Protect (PR.DS) – Data security – protect endpoints accessing sensitive data
- Detect (DE.CM) – Continuous monitoring – monitor for exploitation attempts
recommendations
IMMEDIATE ACTIONS (within 24 hours):
- Update Chrome to Version 152: All users should update Chrome immediately to version 152.0.7977.64 (Linux) or 152.0.7977.64/.65 (Windows and macOS). Chrome will auto-update over the coming days, but users can manually trigger updates by opening Chrome menu → Help → About Google Chrome.
- Verify Auto-Update is Enabled: Confirm that Chrome auto-update is enabled on all managed endpoints. Manually verify a sample of devices by checking Chrome version (chrome://version).
- Check for Chrome Version Compliance: Scan all managed systems to identify devices running Chrome versions below 152. Prioritize updating devices running Chrome 151 or earlier.
- Monitor for Active Exploitation: Review endpoint logs and EDR data for signs of Chrome crashes, memory corruption attempts, or unauthorized code execution within Chrome process.
SHORT-TERM ACTIONS (1-2 weeks):
- Deploy EDR Monitoring: Ensure EDR is configured to alert on suspicious Chrome process activity, including code injection, privilege escalation, unusual network connections, or file access patterns.
- Enforce Chrome Update Policy: Configure Group Policy (Windows), Mobile Device Management (macOS), or Linux package managers to enforce Chrome auto-update on all managed endpoints.
- Review Browser Extension Policies: Audit Chrome extensions deployed across your organization. Disable unnecessary extensions and enforce malware scanning for new installations.
- VPN and Remote Access Audit: If users access VPN or remote access tools through Chrome, ensure MFA is enforced and session monitoring is active.
- Credential Rotation: Reset credentials for critical business applications accessed through Chrome (M365, Salesforce, VPN portals, etc.) to prevent exploitation of potential credential leaks.
ONGOING GOVERNANCE:
- Patch Management SLA: Establish SLA requiring Chrome patching within 48 hours of release. Automate enforcement through configuration management tools.
- Browser Version Inventory: Maintain continuous inventory of Chrome versions across all endpoints. Alert on out-of-compliance versions.
- Continuous Monitoring: Maintain 24/7 monitoring of Chrome process behavior for signs of exploitation or compromise. Configure alerts for crashes, memory corruption indicators, and network anomalies.
- Threat Intelligence Subscription: Subscribe to threat feeds tracking Chrome vulnerability exploitation and new PoC releases. Stay informed of active campaigns.
- Browser Security Policy: Develop comprehensive browser security policy covering auto-update requirements, extension management, safe browsing settings, and restricted sites.
- User Training: Educate users on risks of outdated browsers and importance of allowing auto-updates. Warn against disabling browser security features.
SUPPORTING DOCUMENTATION