Google Patches 26 Chrome Vulnerabilities, Including Critical WebGL and Shared Tab Groups Flaws

Google has released a new update for the Chrome Stable Channel on desktop platforms, addressing 26 security vulnerabilities. This includes two critical use-after-free flaws affecting WebGL and Shared Tab Groups.

The update upgrades Chrome to version 152.0.7977.75 on Windows and macOS, while Linux users receive version 152.0.7977.76. Google stated that the update will be rolled out progressively over the coming days and weeks.

Google Patches 26 Chrome Vulnerabilities

The most serious issue, tracked as CVE-2026-84353, is a critical use-after-free vulnerability in Shared Tab Groups. The second critical flaw, CVE-2026-84352, is a use-after-free vulnerability in WebGL, Chrome’s interface for rendering interactive 2D and 3D graphics with GPU acceleration.

Memory safety flaws, such as use-after-free bugs, can occur when software continues to access memory after it has been freed. This can potentially lead to browser crashes, information disclosure, or conditions that enable code execution, depending on the exploitability and surrounding mitigations.

Google has not disclosed technical details, proof-of-concept code, or evidence of active exploitation for either critical vulnerability. The company indicated that access to bug reports may remain restricted until a majority of users have installed the fixes.

Such restrictions can also remain in place if an issue affects a third-party library that other projects have not yet patched.

In addition to the critical flaws, the release also addresses nine high-severity vulnerabilities across various Chrome components, including FileSystem, Skia, Omnibox, Proxy, Browser, V8, Dawn, GPU, and DataTransfer.

Notable high-severity issues include an incorrect authorization flaw in FileSystem, an information leak in the Skia graphics library, an uninitialized resource issue in the V8 JavaScript engine, and a GPU buffer overflow.

Among the medium-severity fixes are authorization and privilege-management issues in FileSystem, Navigation, Downloads, SiteSettings, Chromoting, and TabStrip.

Google also patched a WebRTC use-after-free vulnerability, a MediaCapture information leak, and issues related to misrepresentation of the FullScreen UI. Low-severity fixes affect Autofill, CredentialProvider, FullScreen, TabStrip, and Actor.

Organizations should prioritize updating their browsers, especially on endpoints used for web-based administration, privileged access, cloud-console sessions, and sensitive business workflows.

Administrators can verify the Chrome versions deployed through endpoint management platforms and ensure that browser auto-update mechanisms are enabled.

Google credited both internal researchers and external contributors, noting that its development process uses technologies such as AddressSanitizer, MemorySanitizer, Control Flow Integrity, libFuzzer, and AFL to identify security defects before release.

CVE Details

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC