#Security

Google ships patches for 26 Chrome security flaws including critical memory bugs in WebGL and Shared Tab Groups

Google has rolled out an update for Chrome's desktop Stable Channel addressing 26 security vulnerabilities across the browser ecosystem. The update bumps Chrome to version 152.0.7977.75/.76 for Windows and macOS, alongside versions 152.0.7977.75 or 152.0.7977.76 on Linux. Leading the release are two critical memory safety defects, tracked as `CVE-2026-84353` and `CVE-2026-84352`. `CVE-2026-84353` represents a critical use-after-free bug in the Shared Tab Groups component, while `CVE-2026-84352` is a use-after-free flaw inside Chrome’s WebGL graphics rendering pipeline. In addition to the critical items, the release resolves nine high-severity vulnerabilities affecting subsystems like `V8`, `Skia`, `Omnibox`, `FileSystem`, and the GPU process. These high-severity flaws include an uninitialized resource condition in `V8` (`CVE-2026-84326`), a GPU buffer overflow (`CVE-2026-84351`), and an incorrect authorization bug in `FileSystem` (`CVE-2026-84354`). The update also mitigates fifteen medium and low-severity defects spanning components like WebRTC, TabStrip, Navigation, and FullScreen UI handling. Google indicated that public bug details remain restricted until a majority of active desktop clients apply the fixes. Furthermore, neither Google nor tracking sources noted any evidence of active exploitation in the wild for these specific CVEs prior to patch deployment.