Chrome 152 Patches 327 Security Flaws, Most Found by Google's Own AI
Google's latest browser update is its biggest in recent memory, fixing hundreds of vulnerabilities at once, with artificial intelligence doing the heavy lifting on discovery.
Key points
- Google released Chrome 152 on Tuesday, patching 327 security vulnerabilities, the largest single update in recent memory.
- Ten flaws carry a "critical" severity rating, meaning attackers could use them to take over a victim's browser or device.
- 299 of the 327 bugs were found by Google's own internal teams using artificial intelligence tools.
- An external researcher named Goodluck earned a $25,000 reward for reporting the single most serious externally discovered flaw, tracked as CVE-2026-79282.
- Google says none of the fixed flaws are being actively used by criminals right now.
Google pushed out Chrome 152 on Tuesday with patches for 327 security vulnerabilities, a number that would have seemed extraordinary even two years ago. The sheer scale reflects how much artificial intelligence, meaning computer programs trained to spot coding mistakes automatically, has changed the pace of security research.
What exactly was wrong with Chrome?
The ten most dangerous flaws are all rated "critical," the highest possible severity. Most are a class of bug called use-after-free, where a piece of the browser's memory gets reused in a way the code never intended, letting an attacker run their own instructions on your computer. Affected components include graphics handling (Angle), the desktop window manager (Aura), Chromecast streaming, the browser's interface layer (Views), and Safe Browsing, the feature that warns you about dangerous websites.
Sixty-one further flaws are rated "high" severity. The remaining hundreds are medium or low risk.
| Severity | Count | Example component |
|---|---|---|
| Critical | 10 | Angle, SafeBrowsing |
| High | 61 | Multiple |
| Medium/Low | 256 | Various |
| Found by AI internally | 299 | Google internal |
| Found externally | 28 | Independent researchers |
Should ordinary Chrome users be worried?
Not if you update today. Google has confirmed no criminal group was exploiting any of these flaws before the patch shipped, which matters: bugs that criminals know about before a fix exists are the most dangerous kind. Once Chrome updates, the holes are closed.
Chrome usually updates itself in the background. To make sure yours is current, open the three-dot menu in the top-right corner, click "Help," then "About Google Chrome." If an update is available, it will install and ask you to relaunch the browser.
A researcher going by the name Goodluck reported the most serious externally found bug, CVE-2026-79282, and Google awarded them $25,000 through its bug-bounty programme, a scheme that pays independent security researchers to find and report flaws rather than sell them to criminals. Several other researchers received smaller payouts for additional discoveries patched in this same release.
For context, as first reported by SecurityWeek, Google has now fixed more than 2,000 Chrome vulnerabilities this year alone, a pace driven almost entirely by AI-assisted internal scanning. External researchers still punch above their weight, delivering the highest-value individual finds, but the volume game now belongs to the machines.
If you use Chrome at work or at home, the only action needed is a browser restart to let the update take effect.
