Two critical Chrome flaws put users at risk on malicious websites

1. Executive summary

Google Chrome Stable 152.0.7977.75/.76 for Windows and macOS and 152.0.7977.75 for Linux fixes 26 security issues, including CVE-2026-84353 and CVE-2026-84352. Both are CVSS 9.6 CRITICAL CWE-416 use-after-free vulnerabilities that could permit arbitrary code execution outside the browser sandbox after Chrome processes crafted HTML. Neither vulnerability is in CISA KEV; this does not prove non-exploitation, and the supplied reporting identifies no observed campaign, payload or threat actor. EMEA financial-services organisations should update and restart desktop Chrome within 24 hours because successful exploitation could move code execution from web content directly onto an endpoint.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

The following is the confirmed vulnerability path, not evidence that exploitation has occurred:

1. Delivery: An attacker must cause Chrome to process a crafted HTML page. For CVE-2026-84353, the reported prerequisite includes social engineering to lure the user to a malicious website or to open HTML-formatted email content. CVE-2026-84352 is triggered through a crafted HTML page.
2. Vulnerable component: CVE-2026-84353 affects Shared Tab Groups. It is a CVSS 9.6 CRITICAL, CWE-416 use-after-free vulnerability and is NOT in CISA KEV. CVE-2026-84352 affects WebGL, Chrome’s browser interface for interactive 2D and 3D graphics. It is also a CVSS 9.6 CRITICAL, CWE-416 use-after-free vulnerability and is NOT in CISA KEV.
3. Memory corruption: Each flaw can cause Chrome to access memory after that memory has been freed. The resulting invalid object or pointer use can cause a crash or potentially allow attacker-controlled code execution.
4. Security-boundary bypass: Successful exploitation could execute arbitrary code outside Chrome’s browser sandbox. This moves impact beyond the restricted browser environment to the underlying operating system. The reporting does not specify the resulting privilege level.
5. Post-exploitation: The confirmed chain ends at potential arbitrary code execution. No payload, malware family, persistence mechanism, privilege-escalation method, command-and-control channel, lateral movement, data-access activity or exfiltration method is reported.

The fixed Stable-channel versions are:

Downloading the update is insufficient until Chrome is restarted. The source does not provide precise lower affected-version boundaries, enterprise deployment commands, registry keys or policy identifiers.

Technical details for both current CVEs are single-sourced to Malwarebytes in the supplied material; verify before enforcement. The related reports concern different Chrome vulnerabilities and do not corroborate exploitation of CVE-2026-84353 or CVE-2026-84352. No threat actor attribution is available.

4. Mitigation & containment

P1 — within 24 hours

• Update desktop Chrome to Stable 152.0.7977.75/.76 on Windows and macOS, or 152.0.7977.75 on Linux.
• Restart Chrome after installation and verify the running version. Do not count an update as complete while the old browser process remains open.
• For manual remediation, open More menu → Settings → About Chrome, allow the update to download, and restart Chrome.
• Until remediation is verified, prevent unpatched Chrome instances from processing untrusted websites or HTML email content. Where operationally possible, withdraw those instances from external browsing.
• If a user reports visiting a suspected crafted page before remediation, isolate the endpoint and preserve browser, EDR and network telemetry. No source-provided IOCs are available to narrow triage.

P2 — within 72 hours

• Confirm version compliance across managed Windows, macOS and Linux endpoints, including devices that were offline during the initial rollout.
• Identify browsers that downloaded the update but were not restarted.
• Investigate failed or delayed updates. The source identifies continuously open browser sessions and update failures as reasons endpoints may lag behind the Stable channel.

P3 — within seven days

• Validate that browser-update controls detect both stale versions and pending restarts.
• Review exception processes for endpoints unable to reach the fixed release and retain browsing restrictions until remediation is complete.
• Conduct targeted retrospective review of web, email and endpoint telemetry for users reporting suspicious HTML content. Absence from CISA KEV must not be used as evidence that exploitation is impossible.

5. Indicators of compromise

No indicators of compromise available in the source material.

The current vulnerability reporting is single-sourced; verify any subsequently derived indicators before enforcement.

6. Detection

Insufficient indicators to author detection rules.

CVE assessment

2 referenced CVEs — 2 critical (CVSS ≥ 9.0)

7. Sources

• Malwarebytes Labs, “Two critical Chrome flaws put users at risk on malicious websites,” https://www.malwarebytes.com/blog/bugs/2026/09/two-critical-chrome-flaws-put-users-at-risk-on-malicious-websites, 2026-09-02.

8. Adverse Trace position

Adverse Trace assesses CVE-2026-84353 and CVE-2026-84352 at their verified CVSS 9.6 CRITICAL severity; both are NOT in CISA KEV. The principal client risk is potential arbitrary code execution outside Chrome’s sandbox following user interaction with crafted HTML, but no exploitation campaign, actor, payload or post-compromise activity is established. Current technical reporting is single-sourced; verify before enforcement. Clients should treat version deployment and browser restart as P1 actions while avoiding claims of active exploitation, and Adverse Trace will monitor for KEV changes, corroborated exploitation reporting and actionable indicators.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.