Chrome 152 Patches Over 300 Vulnerabilities

Summary

Google has released Chrome 152, addressing over 300 vulnerabilities, with a significant portion discovered internally using AI. Ten of these flaws are rated critical, primarily use-after-free issues in various components. While Google's internal AI efforts are yielding many discoveries, external researchers continue to find high-value bugs, with one researcher receiving a $25,000 bounty.

Full text

Google on Tuesday announced the release of Chrome 152, with patches for more than 300 vulnerabilities, the majority of which were discovered internally using AI. Ten vulnerabilities have been assigned a critical severity rating. Most are use-after-free issues in components such as Angle, Aura, Chromecast, Views, and SafeBrowsing. Sixty-one flaws have been rated as high severity, while the rest have medium or low severity. Of the 327 weaknesses patched by the latest Chrome updates, 299 were discovered internally by Google. The use of AI has led to a surge in the discovery of Chrome vulnerabilities this year. However, external researchers are still discovering and reporting high-value flaws in the web browser. A researcher named Goodluck has been awarded $25,000 for a critical vulnerability tracked as CVE-2026-79282. Several others also received thousands of dollars in bug bounties for security holes patched with the latest Chrome update.Advertisement. Scroll to continue reading. Google’s advisory does not mention in-the-wild exploitation. The tech giant has patched well over 2,000 Chrome vulnerabilities to date this year. Related: Chrome, Firefox Updates Patch Dozens of Vulnerabilities Related: Extension Banned for Stealing AI Chats Returns to Chrome Store, Resumes Malicious Activities Related: Google AI Uncovers 13-Year-Old Chrome Flaw Amid Record Patching Pace Related: Google Patches 382 Chrome Vulnerabilities Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs CISA Warns of Exploited Oracle WebLogic VulnerabilityReliaQuest Confirms ShinyHunters Hack, but Says Impact Was Limited91 Vulnerabilities Patched in Spring Application FrameworkVenezuelan Gets Record Federal Prison Term for ATM JackpottingPersonal Information Exposed in Apollo Global Data BreachAnthropic Expands Mythos 5 Access to More Defenders, Unveils $35M Open Source FundBanking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the SpotlightContractors’ CMMC Confidence Rises as Ability to Prove It Falls Behind Latest News Sensitive Information Exposed in Nutex Health Data BreachCISA Warns of Exploited Gitea VulnerabilityLinux Foundation to Govern TRACE, an Open Standard for AI Runtime AttestationAlice Raises $140M to Expand AI Model Defenses and Enterprise GuardrailsWordPress Websites Targeted via MiniOrange Plugin VulnerabilitiesWhatsApp Adds Multiple Passkeys and Stronger 2SV in Account Security UpdateHands-On Cyber-Physical Systems Training Returns to ICS Cybersecurity ConferenceFirst Malware Built Specifically for Car Head Units Fuels Botnet Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Scaling AI Security August 26, 2026 Join this live webinar for a practical framework for evolving your AI security program from a single application to an enterprise AI ecosystem and autonomous agents. Register Webinar: Minimum Viable Business: Can You Prove Your Organization Would Recover? September 2, 2026 In this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk. Register People on the MoveTrellix has named David Pieterse as Chief Operating Officer GTM and David Soto as Chief Information Security Officer.Mike Marshall has been appointed State Chief Information Security Officer at the California Department of Technology.Devi Nair has been appointed Director of Cybersecurity Programs at Aspen Digital.More People On The MoveExpert Insights Silent Patches Don’t Stop Attackers – They Blind Defenders Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk. (Tod Beardsley) Hired for One Job, Judged on Another: The CISO’s Real Problem The skills that get a CISO hired are rarely the skills they are judged on later. Most security leaders are stuck in that gap. Closing it is the real job. (Sravish Sridhar) Rethinking Application Security for the AI Era As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk. (Joshua Goldfarb) The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It Organizations are rushing to implement AI without fully grasping where its legal protections begin and end. (Steve Durbin) Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2026-79282

Entities