Archives 2026

Chrome is rolling out an update for its desktop browser. The update includes 327 security fixes, ten of which address critical vulnerabilities.

The stable channel has been updated to 152.0.7977.64/.65 for Windows and Mac, and 152.0.7977.64 for Linux.

How to update Chrome

If you don’t want to wait for the rollout to reach you, manually updating is easy.

The easiest option is to allow Chrome to update automatically. But you can end up lagging behind on updates if you never close your browser or if something goes wrong, such as an extension preventing the update.

To update manually, click the More menu (three dots), then go to Settings > About Chrome. If an update is available, Chrome will start downloading it automatically. Restart Chrome to complete the update, and you’ll be protected against these vulnerabilities.

You can find an explanation of the version numbering system and step-by-step instructions in our guide: How to update Chrome on every operating system.

Technical details

We want to highlight two vulnerabilities out of the hundreds because we think they could attract attackers if they go unpatched for too long. Both can be triggered by simply visiting a malicious website.

The first is a critical vulnerability in ANGLE (Almost Native Graphics Layer Engine), tracked as CVE-2026-79282. A remote attacker could exploit it using a crafted HTML page to execute arbitrary code outside the browser sandbox.

Chrome uses ANGLE to translate graphics commands used by web pages and browsers into something your operating system and graphics card can process.

Chrome vulnerabilities that enable remote code execution outside the browser sandbox are particularly valuable to attackers because they can turn a visit to a malicious or compromised website into direct code execution on the underlying operating system, often without requiring additional exploitation steps.

A researcher also discovered a use-after-free vulnerability in Chrome’s V8 engine. Tracked as CVE-2026-78899, it has a CVSS score of 8.8 out of 10.  Successful exploitation of this could allow a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

Chrome’s V8 engine is the part of Chrome, and other Chromium-based browsers, that runs JavaScript. Use-after-free is a class of vulnerability caused by incorrect use of dynamic memory during a program’s operation. If, after freeing a memory location, a program does not clear the pointer to that memory, an attacker may be able to use the error to manipulate the program.

The phrase “inside the sandbox” means the malicious code would run in a restricted, sealed-off environment rather than directly on your whole computer. That limits what the attacker can do as it constrains them to the browser, lowering the impact compared with code running outside the sandbox. However, attackers often chain multiple vulnerabilities together to escape the sandbox and achieve a more serious compromise. So, the phrase describes an important security limitation, but it does not mean the vulnerability is harmless.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser ?

Meta has reached a proposed settlement worth up to approximately $18 billion with a bipartisan coalition of 52 attorneys generals over allegations that Facebook and Instagram were deliberately designed to encourage compulsive use by children and teenagers. […]

The Honda CR-V Hybrid has been one of the stronger players in the hybrid SUV market for years, and it’s easy to see why. It looks good, has plenty of useful features, and does a lot of things well without making everyday driving complicated.

With rare exception, I start my day by skimming a handful of RSS feeds specific to my interests and my work. Then, if any of them are relevant to a work project, I paste them into a document so I can reference them later.

The Los Angeles County Museum of Art (LACMA) has announced that a breach last year exposed customer and employee information. […]

The ESP32 can seem overwhelming at first because there are so many projects to try with it. However, you can start out super simple, like the three projects below. These three ESP32 projects are perfect for beginners and can easily be completed in a weekend.

Nothing beats the experience of unboxing a brand-new phone, removing the protective sheets, and turning it on for the first time while you’re gliding all over it with your fingers to get a feel for the case’s texture. After unboxing dozens of phones in my life, this still hasn’t gotten old.

I love reading, but I always find it hard to find the time these days. I read non-stop as a kid, but now I have kids of my own, life seems to get in the way. I’d seen people raving about how a tiny eReader had helped them read far more, and I was skeptical but decided to give it a try.

Modern cars are packed with technology. Touchscreens control everything from climate settings to drive modes, computers constantly adjust suspension and power delivery, and increasingly sophisticated driver-assistance systems are always watching what happens around you. Even the humble manual transmission is rapidly disappearing.

Did you know there is still a good reason to physically destroy your expired credit card?

Scientific research found that the expiration date used by payment terminals on some contactless cards was not effectively protected against tampering.

University of Massachusetts Amherst researchers Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza tested contactless cards across Visa, Mastercard, Discover, and American Express, using multiple terminals and merchants, and cards from five major US banks.

They found that a payment terminal could be tricked into seeing a future expiry date. Basically, they were able to modify the expiration date sent to the terminal to a future date. This allowed them to revive expired Visa contactless credit cards for real in-store purchases. Hence the name “Zombie Card.”

The result was not universal. The tested Mastercard, American Express, and Discover configurations rejected the altered expiry data, while issuer behavior differed even among the tested Visa cards: Some transactions were declined or prompted for a replacement card, while others were approved.

The flaw lies in the Visa Kernel 3 contactless flow, where the terminal-facing Application Expiration Date was not effectively bound to the card’s data. In the tested Mastercard, American Express, and Discover kernels, consistency checks or authenticated-data coverage caused modified expiry data to be detected and the transaction to be declined.

How this could be abused

The most credible abuse case is theft or recovery of an expired or replaced card which the owner regards as harmless. Consider cards left in household waste, a drawer, a lost wallet, or an unsecured corporate disposal stream. If the underlying account remains open and issuer-side controls do not validate the exact card lifecycle state, an attacker could attempt contactless purchases using a relay setup.

Less likely is a scenario that uses a proximity relay attack against a card still held by its owner. That requires sustained NFC (Near Field Communication) proximity and a live relay during the transaction, making it materially harder than merely scanning a card from a passing distance.

How to stay safe

For cardholders, the practical advice is simple:

• Destroy expired and replacement cards. Cut through the chip several times. Make further cuts through the card body to disrupt the contactless antenna, and damage the magnetic stripe before disposing of the pieces.
• Report a lost expired card rather than treating it as inert.

These are sensible precautions, but the primary responsibility lies with payment networks, terminal implementations, and issuers to ensure expiry data is integrity-protected and that authorization systems reject retired card credentials.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free ?