Multiple memory corruption and validation flaws have been identified in desktop browser builds, introducing severe security risks across enterprise and end-user endpoints. The most critical vulnerabilities stem from use-after-free conditions that allow attackers to destabilize application memory and execute arbitrary code. If exploited, an attacker could achieve full remote code execution under the context of the running application, compromising system integrity and exposing sensitive environment data. While no active exploitation or public proof-of-concept exploits have been confirmed in the wild, the underlying flaws create a broad attack surface across desktop environments. System administrators and users must prioritize upgrading targeted deployments to stable patched releases to eliminate exposure to potential remote attacks.
CVE-2026-84353:This vulnerability involves a critical use-after-free (CWE-416) memory corruption flaw within the Shared Tab Groups component. An attacker can exploit this issue by convincing a targeted user to visit a specially crafted web page, leading to unsafe memory handling during active session state transitions. Successful exploitation allows an attacker to achieve arbitrary code execution silently without requiring further user interaction. The overall risk is high due to the potential for complete host compromise, though active exploitation remains unconfirmed.[/subscribe_to_unlock_form]
Multiple memory corruption and validation flaws have been identified in desktop browser builds, introducing severe security risks across enterprise and end-user endpoints. The most critical vulnerabilities stem from use-after-free conditions that allow attackers to destabilize application memory and execute arbitrary code. If exploited, an attacker could achieve full remote code execution under the context of the running application, compromising system integrity and exposing sensitive environment data. While no active exploitation or public proof-of-concept exploits have been confirmed in the wild, the underlying flaws create a broad attack surface across desktop environments. System administrators and users must prioritize upgrading targeted deployments to stable patched releases to eliminate exposure to potential remote attacks.
CVE-2026-84353:This vulnerability involves a critical use-after-free (CWE-416) memory corruption flaw within the Shared Tab Groups component. An attacker can exploit this issue by convincing a targeted user to visit a specially crafted web page, leading to unsafe memory handling during active session state transitions. Successful exploitation allows an attacker to achieve arbitrary code execution silently without requiring further user interaction. The overall risk is high due to the potential for complete host compromise, though active exploitation remains unconfirmed.[emaillocker id="1283"]
CVE-2026-84352:This issue represents a high-severity use-after-free (CWE-416) vulnerability located inside the WebGL graphics processing subsystem. By luring a target to malicious web content designed to abuse WebGL rendering resources, an attacker can corrupt application memory structures. The flaw presents a significant remote code execution threat and could enable remote actors to run unauthorized commands on the underlying host. Despite the absence of confirmed wild exploitation, the flaw poses a severe risk to graphical web browsing workloads.
CVE-2026-84354:This flaw stems from an incorrect authorization and access control mechanism (CWE-863) within core browser functionality. An attacker can leverage this weakness to bypass security boundaries, potentially executing actions outside the intended operational scope of the sandbox environment. Exploitation could allow malicious web content to perform unauthorized operations or escalate capabilities on the endpoint. The risk remains elevated for organizations relying on strict browser isolation controls to prevent secondary network access.
CVE-2026-84359:This vulnerability is an exposure of sensitive information (CWE-200) weakness affecting browser session data handling. Remote threat actors can exploit this bug through crafted web interactions to read uninitialized or protected memory spaces without proper access permissions. Successful exploitation results in the unauthorized leakage of sensitive internal data or tokens, aiding attackers in reconnaissance or secondary exploit chains. While code execution is not direct, the breach of data confidentiality carries notable risk.
CVE-2026-84357:This vulnerability is caused by improper input validation (CWE-20) within the address bar (Omnibox) component. An attacker can craft malicious inputs or manipulated URLs to bypass standard sanity checks, causing unexpected application behavior or UI spoofing. Exploitation of this validation flaw allows attackers to misrepresent destination URLs or manipulate input processing flow to trick users. The overall risk is primarily centered on social engineering vector amplification and potential input handling exploits.
Applying immediate software updates remains essential to secure desktop environments against potential code execution threats. Endpoints must be verified and updated to prevent malicious web pages from triggering memory corruption conditions.
We recommend you to update Google Chrome to version 152.0.7977.75.
The following reports contain further technical details:
[/emaillocker]