Chrome Releases: Stable Channel Update for Desktop

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

• CVE-2026-78953Google Chrome: Missing Authorization
• CVE-2026-79276Google Chrome: Improper Privilege Management
• CVE-2026-79264Incorrect reference resolution in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page
• CVE-2026-79259Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted file
• CVE-2026-79251Improper input validation in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page
• CVE-2026-79248Google Chrome: Incorrect Authorization
• CVE-2026-79238Google Chrome: Incorrect Authorization
• CVE-2026-79217Incorrect authorization in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page
• CVE-2026-79213Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page
• CVE-2026-79211Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page
• CVE-2026-79205Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page
• CVE-2026-79201Improper access control in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page
• CVE-2026-79199Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page
• CVE-2026-79192Improper input validation in Variations in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via crafted network traffic
• CVE-2026-79190Google Chrome: Incorrect Authorization
• CVE-2026-79151Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted file
• CVE-2026-79143Google Chrome: Incorrect Authorization
• CVE-2026-79137Google Chrome: Incorrect Authorization
• CVE-2026-79136Incorrect authorization in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page
• CVE-2026-79116Missing authorization in Viz in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page
• CVE-2026-79087Injection in Chrome Tabs in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass system access restrictions via a crafted HTML page
• CVE-2026-79084Google Chrome: Inadequate Encryption Strength
• CVE-2026-79070Incorrect reference resolution in Cache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page
• CVE-2026-79067Google Chrome: Missing Authorization
• CVE-2026-79050Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page
• CVE-2026-79049Incorrect reference resolution in Passwords in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted file
• CVE-2026-79006Protection mechanism failure in HttpsUpgrades in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via crafted network traffic
• CVE-2026-79003Google Chrome: Incorrect Authorization
• CVE-2026-79000Google Chrome: Improper Input Validation
• CVE-2026-78979Race condition in Core in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page
• CVE-2026-78976Google Chrome: Improper Input Validation
• CVE-2026-78940Improper initialization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page
• CVE-2026-78942Incorrect reference resolution in Loader in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via crafted network traffic
• CVE-2026-79283UI misrepresentation in Geometry in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted HTML page
• CVE-2026-79270Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page
• CVE-2026-79258Incorrect authorization in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page
• CVE-2026-79255Google Chrome: Improper Input Validation
• CVE-2026-79250UI misrepresentation in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof address bar via a crafted HTML page
• CVE-2026-79241Out of bounds read in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page
• CVE-2026-79229Google Chrome: Use of Uninitialized Resource
• CVE-2026-79221Uninitialized resource in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page
• CVE-2026-79204UI misrepresentation in Input in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted HTML page
• CVE-2026-79203Google Chrome: Improper Input Validation
• CVE-2026-79191Google Chrome: Incorrect Authorization
• CVE-2026-79180UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page
• CVE-2026-79173UI misrepresentation in WebAppInstalls in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted HTML page
• CVE-2026-79146Information leak in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app
• CVE-2026-79103Google Chrome: Use of Incorrectly-Resolved Name or Reference
• CVE-2026-79099Missing authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page
• CVE-2026-79089Google Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition

Source and provenance

Original title: Chrome Releases: Stable Channel Update for Desktop. Captured 26 Sept 2026, 20:28 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.