Chrome 152 ships 327 fixes and ten criticals, and the restart is the only one that counts

Chrome downloads its update quietly and applies it when the process restarts, which makes the restart the control point rather than the download. Malwarebytes names the two ways that gate fails in practice: a browser session that never ends, and an extension that breaks the update flow ^[9]. Neither failure looks like a missing patch from the outside. Both leave a machine running the old build while the advisory is public.

That gap matters here because of how little the two highlighted bugs ask of a victim. CVE-2026-79282 in ANGLE, the graphics translation layer, is rated critical, and according to Malwarebytes a crafted HTML page can get arbitrary code running outside the browser sandbox ^[5]. CVE-2026-78899 is a use-after-free in V8 with a CVSS of 8.8, and the same delivery gets code running inside the sandbox ^[6]. Malwarebytes flagged these two out of the hundreds specifically because a visit to a malicious site is the whole precondition ^[8], and it notes that out-of-sandbox execution converts that visit into code on the operating system, often with no further exploitation steps needed ^[7]. The V8 bug is the constrained one, though the same write-up points out that chaining bugs to escape the sandbox is normal attacker practice ^[17].

The provenance numbers are the part worth reading twice. SecurityWeek reports that 299 of the 327 fixes were found internally by Google ^[10], which leaves 28 from outside ^[18], or about 8.6 percent of the release ^[19]. The externally reported minority includes the ANGLE bug, credited to a researcher named Goodluck and paid $25,000 ^[11]. The highest-consequence item in the release, by Malwarebytes' description of it, came from the small share Google did not find itself.

Below the ten criticals sit 61 high-severity flaws, with the remainder medium or low ^[12], which works out to 256 fixes in that tail ^[20]. Most of the criticals are use-after-free issues in components including Angle, Aura, Chromecast, Views and SafeBrowsing ^[4]. Google's advisory does not mention exploitation in the wild ^[13], and that absence is the argument anyone who wants to defer a restart will reach for. It is also the only thing standing between a published critical and a page-load-triggered compromise, and it is not a durable property.

The build strings are 152.0.7977.64/.65 for Windows and Mac and 152.0.7977.64 for Linux ^[3], so any inventory check keyed to a single exact string will misread a fraction of Windows and Mac fleets as unpatched or, worse, the reverse. Google has now patched well over 2,000 Chrome vulnerabilities this year ^[14], with SecurityWeek attributing the surge in discovery to internal AI tooling ^[16]. This one release is around a sixth of that annual total ^[21]. Advisories of this size are the output rate of the finder, not a measure of how bad this Tuesday was.