Chrome 152.0.7977.169 for Windows and Mac Fixes 2 Critical and 8 High-Severity Vulnerabilities

Google released version 152.0.7977.169 for its Chrome Extended Stable channel, targeting Windows and Mac desktop environments. This update addresses ten distinct security vulnerabilities.

What happened

The Chrome team published version 152.0.7977.169 for the Extended Stable release channel on Windows and Mac platforms. According to the official advisory, this build resolves ten security issues. The update is currently rolling out to users over the coming days and weeks, rather than being available to all immediately.

Among the ten fixes, two are rated as critical severity: CVE-2026-110151 and CVE-2026-110922. The remaining eight vulnerabilities are classified as high severity, including CVE-2026-110144, CVE-2026-110159, and CVE-2026-110166. Other high-severity fixes include CVE-2026-110172, CVE-2026-110913, CVE-2026-110918, CVE-2026-110919, and CVE-2026-110921.

Google has not released detailed technical descriptions for these bugs yet. The advisory states that access to bug details and links remains restricted until a majority of users have updated their systems. Restrictions may also persist if the vulnerabilities exist in third-party libraries that other projects depend on but have not yet fixed.

Why it matters

The release includes two critical and eight high-severity fixes, indicating significant security improvements for the Extended Stable channel. For IT managers, the critical ratings signal a higher priority for remediation compared to routine updates. The advisory notes that bug details may remain restricted if the flaws exist in third-party libraries shared with other projects, which could delay full public disclosure.

What to watch

• Monitor the Chrome Security Page for the release of detailed bug reports and exploit information.
• Check internal deployment logs to verify that version 152.0.7977.169 has been installed on managed devices.
• Watch for any follow-up advisories if the flaws involve third-party libraries that require separate vendor patches.
• Review endpoint protection alerts for any anomalous activity related to browser processes during the rollout period.

Who needs to act first

Teams should prioritize updating devices that face the internet or handle sensitive data. Start with web servers, kiosks, and shared workstations before moving to individual employee machines. Verify the update in a small test group to ensure compatibility with enterprise extensions and policies. If immediate patching is not possible, restrict access to untrusted websites and enforce strict content filtering. Back up user profiles before applying the update to prevent data loss during the transition.

Background: Endpoint protection

Endpoint protection focuses on local device behavior and file integrity, not network traffic or user psychology. Misunderstanding these boundaries leads to false confidence. You must combine endpoint tools with network segmentation and user training to close gaps that agents cannot see or stop.

Read the full guide: Endpoint Protection Misconceptions: What Your Security Stack Actually Does

What to do and how to stay safe: Google Chrome

• Force an immediate update check on all Windows and Mac machines running Chrome Extended Stable.
• Verify that version 152.0.7977.169 is installed by checking the browser's "About" page or using management tools.
• Isolate devices that cannot be updated immediately from high-risk network segments or untrusted web traffic.
• Monitor for any third-party library updates from other vendors if the advisory indicates shared code dependencies.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which operating systems are affected by this update?

The update applies to Windows and Mac desktop systems running the Chrome Extended Stable channel.

Are there any critical vulnerabilities in this release?

Yes, two vulnerabilities, CVE-2026-110151 and CVE-2026-110922, are rated as critical severity.

Can I see the technical details of the bugs now?

No, Google has restricted access to bug details until a majority of users have updated or third-party fixes are available.