Google ships patches for 26 Chrome security flaws including critical memory bugs in WebGL and Shared Tab Groups
Google has rolled out an update for Chrome's desktop Stable Channel addressing 26 security vulnerabilities across the browser ecosystem. The update bumps Chrome to version 152.0.7977.75/.76 for Windows and macOS, alongside versions 152.0.7977.75 or 152.0.7977.76 on Linux. Leading the release are two critical memory safety defects, tracked as `CVE-2026-84353` and `CVE-2026-84352`. `CVE-2026-84353` represents a critical use-after-free bug in the Shared Tab Groups component, while `CVE-2026-84352` is a use-after-free flaw inside Chrome’s WebGL graphics rendering pipeline. In addition to the critical items, the release resolves nine high-severity vulnerabilities affecting subsystems like `V8`, `Skia`, `Omnibox`, `FileSystem`, and the GPU process. These high-severity flaws include an uninitialized resource condition in `V8` (`CVE-2026-84326`), a GPU buffer overflow (`CVE-2026-84351`), and an incorrect authorization bug in `FileSystem` (`CVE-2026-84354`). The update also mitigates fifteen medium and low-severity defects spanning components like WebRTC, TabStrip, Navigation, and FullScreen UI handling. Google indicated that public bug details remain restricted until a majority of active desktop clients apply the fixes. Furthermore, neither Google nor tracking sources noted any evidence of active exploitation in the wild for these specific CVEs prior to patch deployment.
Commentary
Browser use-after-free bugs in graphics engines (`WebGL`) and browser chrome features (`Shared Tab Groups`) represent classic pathways for sandbox compromise and remote code execution chains. While renderer-process bugs allow arbitrary execution within sandboxed confines, memory corruption in higher-privileged browser processes (such as Tab management) frequently serves as a broker-level escape vector. Because Chromium forms the backbone of modern corporate browser fleets and numerous Electron-based business tooling, these flaws present wide exposure across standard desktop environments. IT operations and endpoint security teams should ensure progressive auto-update channels are not artificially held back by centralized group policies or endpoint firewalls blocking Omaha update domains. Browser processes should be restarted promptly across workstations to swap the updated shared libraries into memory.
The Quote to Remember
“The company indicated that access to bug reports may remain restricted until a majority of users have installed the fixes.”