Google has begun rolling out Chrome 152 (version 152.0.7977.64/.65 depending on platform), and the release notes read less like a routine update and more like a full security sweep: 327 individual fixes, ten of which Google rates critical. The rollout is staged across Windows, macOS, and Linux over the coming days and weeks rather than pushed all at once.

A pileup of use-after-free bugs

The critical bucket is dominated by a single bug class: use-after-free, where code continues to reference a piece of memory after it has already been freed, opening the door to crashes, information disclosure, or in the worst case arbitrary code execution. Google’s advisory lists critical use-after-free issues in ANGLE (the graphics translation layer that sits between Chrome and the underlying GPU driver), in the Aura windowing system, and in the Chromecast component, alongside a separate input-validation flaw also in Chromecast and a use-after-free in the Views UI framework. An uninitialized-variable bug affecting mobile builds and a use-after-free in Safe Browsing round out the ten.

Below the critical tier, Google also patched a long list of high-severity issues spanning ANGLE, WebGL, the V8 JavaScript engine, WebRTC, the extensions subsystem, autofill, GPU handling, Bluetooth, the sandbox, and the password manager — covering bug types from buffer overflows and out-of-bounds reads to type confusion, authorization gaps, race conditions, and information leaks.

What earned the biggest payout

Google’s Chrome Vulnerability Reward Program paid out a $25,000 bounty for one of the ten critical issues, a use-after-free in ANGLE tracked as CVE-2026-79282 and credited to a researcher going by “Goodluck.” The size of the reward is a reasonable proxy for how exploitable Google’s own security team judged the bug to be, even though there is no evidence it — or any of the other nine critical bugs — has been used in the wild.

No known exploitation, but don’t wait

Google’s advisory is explicit that none of the vulnerabilities fixed in this release are known to be actively exploited. That is a meaningfully different situation from a zero-day patch, and it means there is no need for emergency out-of-band action. That said, the pattern with browser use-after-free bugs is well established: technical write-ups and proof-of-concept exploits tend to follow public disclosure fairly quickly, and browsers are one of the most attractive targets for both criminal and state-linked actors precisely because they process untrusted content from the open internet by design. A ten-critical-bug release is a signal to patch promptly rather than let the update sit in the background for weeks.

How to update

Chrome typically downloads updates automatically, but the new version won’t take effect until the browser is relaunched. Users and IT administrators can force the check manually:

• Open the Chrome menu (three dots, top right) and go to Help > About Google Chrome.
• Chrome will check for updates and download version 152 if it hasn’t already.
• Click “Relaunch” to apply the update — simply leaving the browser open will not activate the fix.

Enterprises managing Chrome through group policy or an MDM platform should confirm the update has been pushed fleet-wide rather than relying on individual users to relaunch their browsers, since the security benefit only applies once the new binary is actually running. Given the volume of memory-safety fixes in this release, organizations with a large Chrome footprint — particularly on shared or unmanaged endpoints — should treat this as a priority patch cycle rather than routine maintenance.