Update Chrome Extended Stable and Stable Channels to Patch 28 and 37 Security Flaws

Google has released new versions of Chrome for the Extended Stable and Stable channels to address multiple security vulnerabilities. The Extended Stable update moves to version 152.0.7977.167 for Windows and Mac, while the Stable channel advances to version 155.0.8059.79 for Linux and 155.0.8059.79/80 for Windows and Mac. These updates roll out over the coming days and weeks.

The risk

The Extended Stable update contains 28 security fixes, including five rated as critical. The Stable channel update addresses 37 security issues, with seven rated as critical. Specific critical flaws include a buffer overflow in ANGLE identified as CVE-2026-110152. Other critical issues involve use-after-free errors in the Browser, PDF, Network, Core, SVG and Media components. High-severity fixes cover issues in Desktop and other modules.

Who is exposed

Users running older versions of Chrome on Windows, Mac and Linux are exposed to these vulnerabilities. The Extended Stable channel serves enterprise and educational environments that require longer support cycles. The Stable channel affects general consumers and developers using the latest release. Any system not yet updated to the specified versions remains vulnerable to the disclosed memory corruption flaws.

Cost and compliance

Google retains restrictions on bug details until a majority of users have updated with the fix. Access to specific bug links may also be restricted if the flaw exists in a third-party library that other projects depend on but have not yet fixed. One reporter, Xinyang Ge, received a $1,000 reward for reporting CVE-2026-110151. Other reporters include Zhenpeng Lin, Google engineers and Findingz.

Our take on the response

Organizations should verify that their Chrome installations have automatically updated to the latest versions. Manual checks are necessary for environments with restricted update policies or offline machines. Prioritize patching systems that handle sensitive PDF documents or process untrusted media, as these components contain critical use-after-free flaws.

What defenders should look for

Teams usually monitor for unexpected process crashes or memory access violations in browser logs. Check whether the browser process consumes abnormal amounts of memory or fails repeatedly when rendering specific file types. Look for indicators of compromise such as unauthorized script execution or attempts to access restricted system resources. Contain affected machines by isolating them from the network and forcing a browser update. Review firewall logs for unusual outbound connections that might indicate data exfiltration after exploitation.

Background: Browser updates

Prepare by auditing current versions and mapping dependencies. Disable auto-updates centrally, test the installer in isolation, and push via management tools. Verify by checking the version string and ensuring no residual files remain. Maintain a strict cycle for future patches.

Read the full guide: How to Implement Browser Updates: A Step-by-Step Guide

What to do and how to stay safe: Google Chrome

• Verify that all managed devices have updated to Chrome 152.0.7977.167 or 155.0.8059.79
• Check for pending updates in environments with manual update controls
• Monitor browser crash logs for patterns indicating memory corruption
• Once the vendor provides an update, ensure it is deployed to all endpoints

Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What are the specific CVE IDs for the critical vulnerabilities in the Stable channel?

The critical CVEs are CVE-2026-110152, CVE-2026-110149, CVE-2026-110136, CVE-2026-110161, CVE-2026-110165, CVE-2026-110148 and CVE-2026-110151.

Which components are affected by the use-after-free bugs?

Use-after-free bugs affect the Browser, PDF, Network, Core, SVG and Media components according to the advisory.

Is there a fix available for the Extended Stable channel?

Yes, the fix is available in version 152.0.7977.167 for Windows and Mac.