Two critical Chrome flaws put users at risk on malicious websites
Google patched 26 Chrome flaws, including two critical use-after-frees and an actively exploited V8 sandbox escape (CVE-2026-85046); update to 152.0.7977.82/.83.
Chrome's desktop update fixes 26 security issues, including critical use-after-free flaws CVE-2026-84353 in Shared Tab Groups and CVE-2026-84352 in WebGL, both allowing code execution outside the browser sandbox via crafted HTML pages. Google subsequently patched CVE-2026-85046, a high-severity V8 JavaScript engine flaw with exploits already in the wild that enables arbitrary code execution inside the Chrome sandbox; HKCERT rates the overall risk as extremely high. Fixed versions are 152.0.7977.82/.83 on Windows and Mac and 152.0.7977.82 on Linux.
- CVE-2026-84353 (Shared Tab Groups) and CVE-2026-84352 (WebGL) are critical use-after-free flaws enabling sandbox-escaping code execution.
- CVE-2026-85046 in V8 is high severity and actively exploited via crafted HTML pages.
- Fixed in Chrome 152.0.7977.82/.83 (Windows/Mac) and 152.0.7977.82 (Linux); 26 fixes total.
- Users should force an update via Settings > About Chrome and restart the browser.
- Vendors
- Products
- Google ChromeV8
- Organizations
- GoogleHKCERTMalwarebytes
- Countries
- Hong Kong
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-84352+1 related CVE | Use-after-free in WebGL in Chrome for Android allows out-of-sandbox code execution | 9.6 | <1% | ||
| CVE-2026-85046 | Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046) | 8.8 | 2% | KEVPoC ×6 | KEV |
From the original article
2 min read at malwarebytes.com
Update Chrome now: Two critical vulnerabilities could allow a malicious website to run code on your device.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.