CVE-2026-84352Patch(google / android)

Google patched 2 critical sandbox-escape bugs plus an actively exploited V8 zero-day (CVE-2026-85046). Visiting a malicious page can be enough. Google shipped two desktop Chrome updates in early September 2026. The first fixed 26 issues, including two critical use-after-free bugs: CVE-2026-84353 in Shared Tab Groups and CVE-2026-84352 in WebGL. Both can let a remote attacker run code outside the sandbox from a crafted webpage. A follow-up update then patched CVE-2026-85046, a high-severity type-confusion bug in the V8 JavaScript engine that Google says is already being exploited. That one lets an attacker run code inside the sandbox via a malicious HTML page. Safe versions are 152.0.7977.82/.83 on Windows and Mac, and 152.0.7977.82 on Linux. Solution: 1. Open Chrome. 2. Click the three-dot menu → **Settings** → About Chrome (or go to `chrome://settings/help`). 3. Let it download the update. 4. Restart Chrome. 5. Confirm the version is 152.0.7977.82/.83 (Windows/Mac) or 152.0.7977.82 (Linux). 6. Update Edge, Brave, Opera, and other Chromium browsers too — they share the same engine. 7. Don’t wait for the automatic rollout if you keep Chrome open for days. Restart is required for the fix to take effect.

#securityupdate #chrome Google が，Chrome 152.0.7977.75/.76 (Windows および Mac) および 152.0.7977.75 (Linux) をリリース． CVE ベースで Critical 2 件 ・CVE-2026-84352 ・CVE-2026-84353 High 9 件 全 26 件の脆弱性に対処． https://x.com/kawn2020/status/2097213207488442658

🚨 [BROWSER SECURITY] — GOOGLE PATCHES 26 CHROME VULNERABILITIES, INCLUDING TWO CRITICAL USE-AFTER-FREE BUGS CAPABLE OF ESCAPING THE BROWSER SANDBOX The critical flaws affect: **Shared Tab Groups** and **WebGL.** CyberSignal Priority: 🔴 HIGH 🆔 CVE-2026-84353 — Critical 🆔 CVE-2026-84352 — Critical 🌐 Google Chrome 152 🏷️ Browser Security · Memory Corruption · RCE · WebGL Google has released a new Chrome security update fixing: **26 vulnerabilities** including two issues classified by Chromium as: **CRITICAL.** Both are use-after-free memory vulnerabilities. ### 🔎 What happened Google's latest Stable Channel update includes: **CVE-2026-84353** Use-after-free in: Shared Tab Groups and: **CVE-2026-84352** Use-after-free in: WebGL WebGL is particularly security-sensitive because it processes complex graphics content supplied by websites while interacting with the browser's GPU stack. Use-after-free vulnerabilities happen when software continues using memory after the memory has already been released. In simplified form: object created ↓ memory allocated ↓ object freed ↓ stale reference remains ↓ attacker manipulates memory layout ↓ browser accesses stale pointer ↓ memory corruption ↓ potential attacker-controlled execution ### ⚔️ Potential exploitation path Victim visits attacker-controlled content ↓ crafted browser content triggers vulnerable component ↓ use-after-free condition ↓ memory layout manipulated ↓ attacker-controlled behavior ↓ arbitrary code execution Google's CVE records describe the critical flaws as potentially allowing: **arbitrary code execution outside the sandbox** through crafted HTML under affected conditions. ### 🎯 What was patched Beyond the two critical bugs, Google fixed high-severity issues affecting components including: • Proxy • Browser • V8 • Dawn • GPU • FileSystem • Omnibox • Skia • DataTransfer Additional vulnerabilities affect: WebRTC Downloads Navigation SiteSettings Chromoting MediaCapture TabStrip CredentialProvider FullScreen Autofill The update therefore covers far more than one isolated browser feature. ### 🧠 Why this matters The browser remains one of the most exposed applications on almost every endpoint. It constantly processes attacker-controlled: HTML JavaScript images fonts graphics media WebGL network responses A critical memory-corruption bug therefore has an unusually attractive attack surface. The attacker does not necessarily need: VPN credentials RDP access SSH a malicious executable sent directly to the user The browser itself is already designed to accept complex untrusted input from the internet. ### ⚠️ Important caveat Google has **not stated that these 26 vulnerabilities are actively exploited in the wild.** That distinction matters. Critical vulnerability: ≠ confirmed zero-day exploitation. So this should NOT be posted as: “Chrome zero-days actively exploited.” There is currently no evidence supporting that claim for these vulnerabilities. Google also restricts technical bug details while patches are still propagating, which is normal for Chrome security releases. ### 🛡️ Defender action Update Chrome immediately. Fixed desktop versions include: Windows / macOS: **152.0.7977.75/.76** Linux: **152.0.7977.75** Then: restart Chrome ↓ verify deployed version ↓ check enterprise fleet compliance ↓ identify endpoints stuck on older releases ↓ prioritize browsers exposed to uncontrolled internet content Managed environments should verify the update actually completed. A downloaded browser update that has not been restarted is not the same as a patched running browser. **CyberSignal insight: Browsers are effectively internet-facing interpreters installed on every employee endpoint. A memory-corruption bug in that boundary can turn ordinary web content into an initial-access primitive.** Sources: Google Chrome Releases · CyberPress · NVD

【重要】Android版ChromeにCVSS 9.6、修正版へ更新を https://www.cybernote.click/2026/09/03/google-chrome-android-cve-2026-84352-84353-sandbox-escape/ #IT #Security #cybersecurity

【重要】Android版ChromeにCVSS 9.6、修正版へ更新を https://www.cybernote.click/2026/09/03/google-chrome-android-cve-2026-84352-84353-sandbox-escape/ #IT #Security #cybersecurity

Google Chrome の 26件の脆弱性が FIX：CVE-2026-84353／84352 によるメモリ破壊の恐れ https://iototsecnews.jp/2026/09/01/google-fixes-26-chrome-vulnerabilities-including-2-critical-use-after-free-flaws/ Google Chrome の共有タブグループや WebGL などにプログラムの解体／再利用時における不正領域参照／領域越え入力／不完全検証といった欠陥が存在します。これらによりメモリ損傷／アプリケーション強制終了／遠隔コード実行／秘密情報流出のリスクが懸念されます。影響を受ける型番の追跡記号は CVE-2026-84353／CVE-2026-84352／CVE-2026-84354／CVE-2026-84359／CVE-2026-84357／CVE-2026-84324／CVE-2026-84349／CVE-2026-84333／CVE-2026-84326／CVE-2026-84351 です。対策として最新版 152.0.7977.75 以降への即時適用が求められます。 #Chrome #CVE202684352 #CVE202684353 #Google #Vulnerability

【重要】Android版ChromeにCVSS 9.6、修正版へ更新を https://www.cybernote.click/2026/09/03/google-chrome-android-cve-2026-84352-84353-sandbox-escape/ #IT #Security #cybersecurity

【重要】Android版ChromeにCVSS 9.6、修正版へ更新を https://www.cybernote.click/2026/09/03/google-chrome-android-cve-2026-84352-84353-sandbox-escape/ #IT #Security #cybersecurity

CVE-2026-84352 Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HT… https://www.cve.org/CVERecord?id=CVE-2026-84352

#Google has released security #update for #Chrome which address multiple vulnerabilities. #CVE-2026-84353 #CVE-2026-84352 https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html

Chrome 152 για Android: CVE-2026-84352 με εκτέλεση κώδικα https://secn.ws/hAPgL3