Chrome 152's security drop patches 327 flaws, 10 of them Critical with sandbox escapes, and sets the new evergreen baseline every browser build has to reach.
Chrome 152 hit stable on August 25, and the number to know is 327: that's how many security flaws Google patched, 10 of them rated Critical. This is the new evergreen baseline, not a routine refresh. Anything still on an older Chrome build is running the exact attack surface this release closes.
The cluster that deserves your attention is a set of use-after-free bugs in Aura, ANGLE, Chromecast, Views, and Safe Browsing. Several of them break out of the renderer sandbox and can lead to arbitrary code execution outside it, the worst outcome a browser bug can produce: a malicious page with a real shot at running code on your machine, not just inside a tab.
You patch everywhere, not just your own browser. Verify the version after updating: 152.0.7977.64 on Linux, .64/.65 on Windows and Mac. If you pin a browser build anywhere, treat this release as the floor that version has to clear.
The size of the fix list is itself the story. A drop this big resets what "current" means for frontend code, and the bar is higher now. You want to be on the updated side of that line before the next release lands.
A week after the 327-fix build, Chrome stable moves to 152.0.7977.75/.76 with 26 fixes, including two Critical use-after-frees in WebGL and Shared Tab Groups that can lead to code execution outside the sandbox.
1 source
sharp below 0.35.4 inherits two libheif flaws rated critical upstream that can reach remote code execution on glibc-based Linux. The fix is a version bump or a one-line AVIF block.
2 sources
Next.js shipped its first pre-announced monthly security release on July 20, patching 9 vulnerabilities (4 high severity) across v16.2.11 and v15.5.21.
1 source