Google Releases Chrome 152 Fixing 327 Vulnerabilities Including 10 Critical Flaws
Google has released the latest version of its web browser, Chrome 152, addressing a total of 327 vulnerabilities. The update was made available on August 25, 2026, and includes patches for Windows, macOS, and Linux platforms.
The company distributed version 152.0.7977.65 and 152.0.7977.64 for Windows and macOS, along with 152.0.7977.64 for Linux. Among the fixed issues, ten vulnerabilities were rated Critical, the highest severity level in Google's four-tier classification.
One notable fix addresses a Use After Free flaw in the graphics processing component ANGLE, tracked as CVE-2026-79282. Additional Use After Free vulnerabilities were resolved in the Aura component, including CVE-2026-79290 and CVE-2026-79052.
The Chromecast module also received multiple patches. These include Use After Free issues identified as CVE-2026-79054 and CVE-2026-79224, as well as an input validation flaw tracked as CVE-2026-79121.
Security researchers recommend that all users install the update without delay to reduce exposure to potential remote code execution attacks.
Related articles
Out of 48,000 Vulnerabilities Only 1% Are Dangerous: How to Find Them Using CVSS 4.0, EPSS, KEV and FSTEC Methodology
The article explains why prioritizing vulnerabilities is critical in 2025-2026 as exploitation became the top initial access vector for the first time in 19 years according to Verizon DBIR. It details the limitations of CVSS scoring alone, the shift to CVSS 4.0 with new metrics like Attack Requirements and Supplemental Metrics, and the impact of NIST reducing NVD enrichment to only actively exploited or federal software cases. EPSS provides daily exploitation probability predictions using machine learning on over 1,100 features, while CISA KEV and the new LEV metric help identify confirmed or likely exploited vulnerabilities. The text covers practical prioritization criteria including asset significance, exploit availability, and network exposure, plus challenges for Russian infrastructure due to CVE dependency. It also compares CISA KEV with commercial catalogs like VulnCheck KEV that detect exploitation earlier.
Veeam ONE Receives Security Update Addressing Critical Vulnerabilities Including CVE-2026-65641
Veeam Software has released updates for its backup environment monitoring tool Veeam ONE to address multiple vulnerabilities. The advisory covers the 13.x series and includes fixes rated as critical under CVSSv4.0. One flaw, CVE-2026-65641, allows service accounts to perform SMB authentication and carries a base score of 9.3. Additional high-severity issues such as CVE-2026-64633 with a perfect 10.0 score were also resolved in the patches. The company updated its disclosure to include seven vulnerabilities fixed in version 13.1.0.7034 after initially reporting six. Patches are now available for both the 13.x and 12.x branches, with the latest 12.3 Patch 1 backporting several fixes from the 13 series.
Three Critical Vulnerabilities in Adobe Campaign Classic Allow Arbitrary Code Execution
Adobe has disclosed three severe vulnerabilities in Adobe Campaign Classic that could permit attackers to execute arbitrary code on affected systems. The issues affect both Windows and Linux versions and include two OS command injection flaws along with one server-side request forgery vulnerability. Each vulnerability received the maximum CVSSv3.1 base score of 10.0 and is rated Critical. Adobe released fixes in version 7.4.4 build 9401, which must be applied to on-premises components in both pure on-premises and hybrid environments. Although no active exploitation has been observed, Adobe assigned the highest priority level and recommends applying the update within 72 hours.
Dirty COW CVE-2016-5195: How a 2016 Linux Kernel Race Condition Still Enables Privilege Escalation in Embedded Systems
The 2016 Linux kernel vulnerability CVE-2016-5195, known as Dirty COW, allowed local users to bypass copy-on-write protections and modify read-only memory mappings through a race condition involving writes to /proc/self/mem and madvise calls. Although patched in supported distributions years ago, the flaw persists in older kernels running on routers, cameras, and industrial controllers that receive infrequent firmware updates. Public exploits often target /etc/passwd or SUID binaries for root access, but success depends heavily on the presence of login mechanisms, BusyBox applets, and suitable binaries in the target environment. When standard targets are absent, attackers may pivot to overwriting vDSO functions in process memory to inject code executed by higher-privileged processes. The article explains why ready-made PoCs frequently fail on minimal BusyBox-based systems and outlines the checks required for architecture, ABI, vDSO symbols, and payload compatibility. It also references the practical exercise Strange And Dirty on the free White Hacker course for hands-on adaptation of the exploit chain.