Google has shipped Chrome 152, a security update addressing more than 300 vulnerabilities, the largest share of which were surfaced internally through AI-assisted discovery methods rather than external bug reports.

Of the 327 weaknesses fixed in this release, 299 were found by Google’s own teams. The company has increasingly relied on AI tooling to hunt for flaws in Chrome’s codebase, a shift that has driven a sharp rise in the number of vulnerabilities identified and patched throughout the year. Google has now fixed well over 2,000 Chrome vulnerabilities in total this year.

Critical and High Severity Issues

Ten of the patched flaws carry a critical severity rating. Most are use-after-free vulnerabilities affecting components including Angle, Aura, Chromecast, Views, and SafeBrowsing. Use-after-free bugs remain a common and dangerous class of memory-safety issue in browsers, often exploitable for remote code execution if chained with other weaknesses.

An additional 61 vulnerabilities were rated high severity, with the remainder classified as medium or low severity.

External Researchers Still Cashing In

Despite the growing role of AI in internal vulnerability hunting, external security researchers continue to find high-value issues in Chrome. A researcher using the handle Goodluck was awarded 25,000 dollars for reporting a critical vulnerability tracked as CVE-2026-79282. Several other researchers also received bug bounty payouts, some in the thousands of dollars, for flaws addressed in this update.

No Evidence of Exploitation

Google’s security advisory for Chrome 152 does not indicate that any of the patched vulnerabilities have been exploited in the wild. Even so, the volume and severity of the fixes, particularly the critical-rated use-after-free issues, underscore the pace at which flaws are being both discovered and resolved in modern browser codebases.

Recommendations for Security Teams

  • Ensure Chrome is updated to version 152 across managed fleets, since browsers remain a primary attack surface for endpoint compromise.
  • Prioritize patching on systems where automatic updates may be delayed or disabled by policy.
  • Monitor for any follow-on advisories, as critical use-after-free bugs are frequently targeted once technical details or proof-of-concept exploits become available.