Google Chrome Update Patches 26 Flaws, Two Critical
Google Patches Two Critical Use-After-Free Flaws in Chrome
CVE Identifiers
MITRE ATT&CK Techniques
Full Report(when first published)
Executive Summary
Google has released a security update for its Chrome browser, addressing 26 security vulnerabilities. The update, version 152.0.7977.75 for Windows and Mac and 152.0.7977.76 for Linux, is most notable for patching two critical use-after-free vulnerabilities. These flaws, if exploited, could allow an attacker to crash the browser or, in a worst-case scenario, execute arbitrary code on the victim's system. While Google has stated there is no evidence of these vulnerabilities being exploited in the wild, users are strongly encouraged to update their browsers immediately to mitigate the risk.
Vulnerability Details
The two critical vulnerabilities are both use-after-free memory corruption bugs, which are a common vector for achieving remote code execution in browsers.
- CVE-2026-84353: A critical use-after-free vulnerability in the Shared Tab Groups component. An attacker could exploit this by tricking a user into visiting a specially crafted HTML page. Successful exploitation could lead to code execution outside of the browser's security sandbox.
- CVE-2026-84352: A critical use-after-free vulnerability in WebGL, Chrome's API for rendering 2D and 3D graphics. Similar to the first flaw, this could be triggered by a malicious website, potentially allowing an attacker to manipulate memory and execute arbitrary code.
In addition to these critical flaws, the update also patches nine high-severity bugs in components such as FileSystem, Skia, Omnibox, and the V8 JavaScript engine.
Affected Systems
- Google Chrome versions prior to
152.0.7977.75on Windows and macOS. - Google Chrome versions prior to
152.0.7977.76on Linux.
Exploitation Status
According to Google, there is currently no evidence to suggest that CVE-2026-84353 or CVE-2026-84352 are being actively exploited in the wild. Google is restricting access to the full technical details of the bugs until a majority of users have applied the update to prevent reverse-engineering and weaponization of the flaws.
Impact Assessment
Use-after-free vulnerabilities are particularly dangerous because they can corrupt memory in a way that allows an attacker to hijack the program's execution flow. A successful exploit of either of these critical flaws could have the following impacts:
- Remote Code Execution: An attacker could run malicious code on the victim's computer with the same permissions as the logged-in user.
- System Compromise: If the attacker successfully escapes the browser sandbox, they could potentially install persistent malware, steal sensitive files, or use the compromised machine as a pivot point to attack other systems on the network.
- Information Disclosure: Even a failed exploit attempt could crash the browser, potentially leading to the disclosure of sensitive information from memory.
Cyber Observables — Hunting Hints
As there are no public exploits, detection is focused on prevention and inventory.
C:\Program Files\Google\Chrome\Application\chrome.exe/Applications/Google Chrome.app/Contents/MacOS/Google Chromechrome.exeDetection Methods
Detecting exploitation of browser vulnerabilities is challenging without specific signatures. The focus for defenders should be on identifying and remediating vulnerable instances.
- Asset Inventory: Use enterprise management tools (e.g., SCCM, Jamf) or EDR platforms to query the installed version of Google Chrome on all endpoints.
- Vulnerability Scanning: Run authenticated vulnerability scans against endpoints to automatically detect outdated and vulnerable browser versions.
- Network-based Detection: While not specific to these CVEs, network security tools can sometimes detect browser exploit kits or connections to malicious domains hosting exploit code.
Remediation Steps
The primary and only effective remediation is to update the browser.
- Update Google Chrome: Users should navigate to
Help > About Google Chromein their browser settings to trigger the automatic update process. A relaunch of the browser will be required to apply the update. - Enforce Update Policies: In an enterprise environment, use Group Policy (GPO) or MDM solutions to enforce automatic updates for Google Chrome and ensure that browsers are restarted regularly to apply pending updates. This is a direct implementation of D3FEND's
Software Update (D3-SU). - User Communication: Inform users about the importance of this critical update and instruct them to restart their browsers to ensure they are protected.
Timeline of Events
Article Updates
September 3, 2026
Mozilla Firefox also released version 155, patching 29 vulnerabilities including 13 high-severity memory corruption and sandbox escape issues, alongside Google's Chrome update.
Update Sources:
MITRE ATT&CK Mitigations
Update Software
Updating Google Chrome to the latest version is the only way to remediate these vulnerabilities.
Restrict Web-Based Content
Using web filtering and other security controls can prevent users from accessing malicious websites that host browser exploits.
Exploit Protection
Modern operating systems and browsers include exploit protection features like ASLR and DEP that can make successful exploitation of memory corruption flaws more difficult.
D3FEND Defensive Countermeasures
The most critical action for all users and organizations is to ensure Google Chrome is updated to a patched version (152.0.7977.75/.76 or newer). For enterprise environments, this should be managed centrally. Use tools like Windows Group Policy (GPO) or a Mobile Device Management (MDM) solution to force-install updates. Configure policies to automatically restart browsers after a set period (e.g., 72 hours) to ensure updates are applied, as many users leave their browsers open for extended periods. This proactive approach ensures that the window of opportunity for attackers to exploit these critical flaws is minimized across the entire organization.
While not a direct fix, ensuring that Data Execution Prevention (DEP) is enabled at the OS level provides a crucial layer of defense against the exploitation of use-after-free vulnerabilities like CVE-2026-84353 and CVE-2026-84352. DEP prevents code from being executed from memory regions marked as non-executable. In the context of a browser exploit, this can stop an attacker's shellcode from running even if they successfully corrupt memory. Modern operating systems have this enabled by default, but security teams should verify this configuration on all endpoints, especially legacy systems, to ensure this fundamental exploit mitigation is active.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.