Google has rolled out a Chrome update that closes 26 security vulnerabilities, including two critical bugs that could let an attacker crash your browser or potentially run code on your machine just by getting you to visit a malicious page. If you haven't restarted your browser in a while, there's a good chance you're still running the vulnerable version. Here's what changed, why it matters, and exactly how to check and fix it.
What Happened
Google pushed Chrome 152.0.7977.75/.76 for Windows and macOS, and 152.0.7977.75 for Linux. The update is rolling out gradually over the next few days to weeks through Chrome's automatic update system, which is why some people already have it and others don't yet.
Two of the 26 fixes are rated critical:
- A use-after-free bug in Shared Tab Groups — a flaw where the browser keeps using a piece of memory after it's already been freed, which an attacker can sometimes manipulate to corrupt memory or execute code.
- A use-after-free bug in WebGL — the same class of memory-safety issue, but in the component that renders interactive 2D and 3D graphics in the browser. This one is particularly concerning because it can potentially be triggered just by loading a web page, ad, or app that uses graphics-related browser functions.
The remaining fixes cover high, medium, and low-severity issues across components including the V8 JavaScript engine, the Omnibox (address bar), file system permissions, downloads, autofill, and tab handling. Google hasn't said whether any of these are being actively exploited, but as a matter of policy it withholds full technical details on bugs like this until most users have updated — which limits how easy it would be for someone to reverse-engineer an exploit from the bug report itself.
How to Check If You're Protected
- Open Chrome.
- Click the three-dot menu in the top-right corner, then go to Help > About Google Chrome (or just type
chrome://settings/helpinto the address bar). - Chrome will show your current version and automatically check for updates.
- If you're on version 152.0.7977.75 or later, you're already protected.
- If an update is available, Chrome downloads it automatically — you just need to click Relaunch to finish applying it. Nothing installs until you restart the browser.
Why Restarting Actually Matters
This is the part people miss most often: Chrome downloads security updates in the background well before you see them applied. The download step alone doesn't protect you — the update only takes effect after you relaunch the browser. If you're the type to keep dozens of tabs open for weeks at a time, you could be sitting on a downloaded fix without actually running it.
If you'd rather not lose your tabs, Chrome remembers and restores them automatically on relaunch on most setups, so it's safe to click that button rather than keep postponing it.
For IT Admins and Managed Devices
If you're managing Chrome across an organization, don't rely on individual users to restart their own browsers. Verify managed endpoints have actually picked up 152.0.7977.75 or later through your device management console, and consider pushing a forced relaunch policy for critical updates like this one, since use-after-free vulnerabilities of this severity are exactly the kind that get weaponized once technical details leak out.
Quick Recap
| Step | What to Do |
|---|---|
| Check your version | chrome://settings/help |
| Confirm you're safe | Version 152.0.7977.75 or later |
| If an update is pending | Click Relaunch — download alone isn't enough |
| Enterprise/managed devices | Verify rollout through your device management console |
Chrome updates itself automatically in the vast majority of cases, so the single most useful habit here isn't anything technical — it's just restarting your browser every few days instead of letting it run for weeks on end.