Summary
| Parameter | Value |
|---|---|
| CVE ID (lead entry) | CVE-2026-84325 |
| Vulnerabilities covered | 6 (CVE-2026-84325, CVE-2026-84324, CVE-2026-84333, CVE-2026-84352, CVE-2026-84353, CVE-2026-84354) |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-09-02 |
| Vendor | |
| Product | Chrome (stable channel) |
| Fixed version | 152.0.7977.75 |
| CVSS Score | 9.8 down to 9.0 (critical) |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
The Chrome 152.0.7977.75 stable channel release closes six vulnerabilities rated 9.0–9.8 CVSS in the NVD. Five of them lead to code execution outside the browser sandbox — breaking the layer meant to isolate web content from the operating system.
| CVE | CVSS (NVD) | Component | Vulnerability class | Notes |
|---|---|---|---|---|
| CVE-2026-84325 | 9.8 | DataTransfer | improper input validation | bypasses system access restrictions via a co-installed app; requires social engineering |
| CVE-2026-84333 | 9.6 | Dawn | use-after-free | Chrome on Android; vector is a crafted HTML page |
| CVE-2026-84352 | 9.6 | WebGL | use-after-free | Chrome on Android; Chromium severity: Critical |
| CVE-2026-84353 | 9.6 | Shared Tab Groups | use-after-free | Chrome on Android; requires social engineering |
| CVE-2026-84354 | 9.6 | FileSystem | incorrect authorization | code execution outside the sandbox; requires social engineering |
| CVE-2026-84324 | 9.0 | Proxy | use-after-free | vector is crafted network traffic, not a page — works against a browser that never visited a hostile site |
Why this matters in an organisation, not just on a personal laptop. The browser is now the primary interface to corporate systems — mail, ERP, cloud consoles, admin panels. A sandbox escape means code from any visited page runs with the user’s privileges on the workstation: it reaches their session tokens, their disk and the internal network. That is a textbook entry point for lateral movement.
CVE-2026-84324 (Proxy) deserves particular attention. The other five require the user to open a crafted page or fall for social engineering. This one triggers on crafted network traffic — meaning an attacker controlling the network path or a proxy server can exploit it without any user action beyond using the browser.
Required Actions
- Update Chrome to 152.0.7977.75 or later on all workstations and Android devices.
Check the version at
chrome://settings/help, which also forces an update check. - Force a browser restart. Chrome downloads the update in the background, but the new code only takes effect once the process restarts. A workstation with a downloaded but un-restarted browser is still vulnerable — and users routinely leave Chrome running for weeks.
- Review Chrome Enterprise policies.
TargetVersionPrefixandUpdateDefaultare often configured to defer rollouts; for a critical sandbox escape that deferral needs to be deliberately shortened. - Update other Chromium-based browsers — Microsoft Edge, Brave, Opera, Vivaldi. Five of the six flaws sit in Chromium components, so they apply there as well; those vendors ship their own releases with the same fix.
- Inventory Electron-based desktop applications (messengers, cloud clients, internal tools). They bundle their own copy of Chromium, which does not update alongside the browser and stays vulnerable until the application ships a new version.
Who Is Affected?
The vulnerabilities affect Google Chrome prior to 152.0.7977.75 — stable channel, all platforms. Three of the six (CVE-2026-84333, CVE-2026-84352, CVE-2026-84353) are described by Google as affecting Chrome on Android; the remaining three are not limited to a single platform and cover Windows, macOS and Linux workstations.
In practice this affects every organisation that issues Chrome-equipped workstations, plus Android device fleets under MDM. Indirectly it also affects users of other Chromium-based browsers and of applications built on Electron.
Sources
- NVD - CVE-2026-84325
- Chrome Releases - Stable Channel Update for Desktop
- Chromium issue 553117928 (CVE-2026-84325)
- NVD - CVE-2026-84324
- NVD - CVE-2026-84333
- NVD - CVE-2026-84352
- NVD - CVE-2026-84353
- NVD - CVE-2026-84354
- FIRST EPSS
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
