Google has pushed a new Chrome stable release for the desktop, and one of the flaws it closes can be triggered by nothing more than loading a web page. A remote attacker who gets somebody to visit a crafted page can run code outside the browser's sandbox, which means on the computer itself rather than inside the sealed compartment Chrome normally keeps web content in.
The desktop stable channel has moved to 152.0.7977.64 and .65 on Windows and Mac, and 152.0.7977.64 on Linux. Writing up the release, Malwarebytes counts 327 security fixes in it, ten of them for flaws rated critical, and picks out two as the ones most likely to draw attackers if they sit unpatched.
A graphics translator with too much reach
The first, CVE-2026-79282, is a critical flaw in ANGLE, the layer Chrome uses to translate the graphics instructions a web page issues into something the operating system and graphics card can process. Malwarebytes reports that a remote attacker can exploit it with a crafted HTML page to execute arbitrary code outside the browser sandbox. That is the category of Chrome bug worth real money to attackers, because it collapses the usual multi-step chain. A single visit to a malicious or compromised site becomes code running on the underlying system, often with no further exploitation required.
Inside the sandbox is not the same as safe
The second, CVE-2026-78899, is a use-after-free flaw in V8, the engine that runs JavaScript in Chrome and in every other Chromium-based browser. It carries a CVSS score of 8.8 out of 10 and allows a remote attacker to execute arbitrary code inside the sandbox by way of a crafted HTML page. Use-after-free is a memory handling mistake: a program frees a chunk of memory but keeps a pointer to it, and an attacker who can control what lands in that memory next may be able to steer the program.
Running inside the sandbox is a real limitation. Code stuck there is confined to the browser rather than loose on the machine, which lowers the impact considerably. It is not a reason to relax, though, because chaining a sandbox-internal bug to an escape is exactly how serious browser compromises get built, and this release happens to ship both halves of that pattern.
Update and restart, do not just leave it open
Chrome updates itself, but the update only takes effect when the browser restarts. If you keep dozens of tabs open for weeks, or an extension has quietly broken the update process, you can sit on an old build indefinitely. Force it: open the three-dot menu, go to Settings and then About Chrome, let it download, and restart when prompted. Chromium-based browsers share V8 and ANGLE, so users of Edge, Brave, Opera and Vivaldi should watch for their own updates rather than assume they are unaffected.
This is the third browser update worth acting on in a fortnight. We covered a critical Chrome Remote Desktop flaw and a Chromium sandbox escape shipped in Edge 151 earlier this month.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.