Security52s read
Chrome 152 Stable Patches 327 Security Flaws, 10 Critical
Chrome 152's security drop patches 327 flaws, 10 of them Critical with sandbox escapes, and sets the new evergreen baseline every browser build has to reach.
1 source
Security54s read
Chrome 152.0.7977.75: Two Critical Use-After-Frees in a Follow-Up Security Drop
A week after the 327-fix build, Chrome stable moves to 152.0.7977.75/.76 with 26 fixes, including two Critical use-after-frees in WebGL and Shared Tab Groups that can lead to code execution outside the sandbox.
Chrome 152 stable moved again on September 1, this time to 152.0.7977.75/.76 on Windows and Mac and 152.0.7977.75 on Linux. It is the second security drop for this release in a week, following the 327-fix build from August 25, and it ships 26 fixes: 2 Critical, 9 High, 10 Medium, 5 Low.
The two Criticals are use-after-free bugs, and Google's own team reported both. CVE-2026-84353 hits Shared Tab Groups, CVE-2026-84352 hits WebGL. Each can be triggered by a crafted HTML page and is capable of remote code execution outside the renderer sandbox. No active exploitation has been confirmed, so treat this as patch-not-panic rather than an emergency.
The Highs read like a tour of the renderer: V8 with an uninitialized resource (CVE-2026-84326), Skia leaking information (CVE-2026-84359), a buffer overflow in the GPU process (CVE-2026-84351), and use-after-frees in Dawn and the proxy (CVE-2026-84333, CVE-2026-84324). Google is keeping the bug details restricted until most users update.
You close this the way you closed last week's: restart Chrome and confirm 152.0.7977.75 or .76 in chrome://settings/help. Then remember that every Electron app you maintain pins its own Chromium, and check those too. If your CI locks a browser build, raise the floor again. Current moved twice in seven days.
More like this
Security58s read
sharp 0.35.4 Fixes libheif RCE: Critical Upstream, High in the Advisory
sharp below 0.35.4 inherits two libheif flaws rated critical upstream that can reach remote code execution on glibc-based Linux. The fix is a version bump or a one-line AVIF block.
2 sources
Tooling55s read
pnpm 12 Goes Stable: Deterministic Lockfiles, Faster Peer Resolution, and Workspace Task Orchestration
pnpm 12.0.0 shipped stable on August 26 and 12.1/12.2 landed this week, bringing deterministic lockfiles, 2-3x faster peer resolution on cycle-heavy workspaces, workspace task orchestration, and shared build artifacts.
1 source