Google Chrome 153 Released With Fixes for 42 Security Vulnerabilities

Google has released Chrome version 153 to the Stable channel for desktop, addressing 42 security vulnerabilities, including three critical-severity flaws affecting WebGL, Chrome internals, and Workers.

This update is being rolled out as version 153.0.8010.47/48 for Windows and macOS, and as version 153.0.8010.47 for Linux.

The release includes a wide range of memory-safety, authorization, race-condition, and type-confusion flaws across core browser components.

Although Google’s bulletin does not indicate that any of the vulnerabilities are currently being exploited in the wild, the critical use-after-free and out-of-bounds read issues underscore the importance of prompt patching for consumers, enterprises, and managed-browser deployments.

Critical Flaws Addressed

The most severe issue is CVE-2026-91726, an out-of-bounds read vulnerability in WebGL, which Google reported internally on September 3. This flaw arises from improper bounds handling in graphics-processing paths.

It could disclose information or help compromise the browser process if attackers can trick a victim process into loading harmful web content.

Chrome 153 also resolves CVE-2026-91721, a use-after-free flaw in Internals, and CVE-2026-91749, another use-after-free vulnerability in Workers.

Use-after-free bugs occur when software continues to access memory after it has been released; in browsers, such vulnerabilities are particularly critical as they can sometimes be exploited to execute code or escape from sandboxed environments.

Twenty-eight of the fixes are classified as high severity. These include use-after-free vulnerabilities in components such as Input, Skia, DOM, Core, Auth, PDF, DigitalCredentials, WebAppInstalls, and V8; an integer overflow in the V8 JavaScript engine; and an out-of-bounds write in ServiceWorker.

Several fixes impact web-facing features that organizations commonly enable by default, including ServiceWorker, CacheStorage, WebUI, extensions, network components, ANGLE, and the PDF renderer.

Notable authorization-related vulnerabilities were addressed in Core, Extensions, WebUI, and Android functionalities. Google also fixed race conditions in Core, PlatformIntegration, Extensions, Network, and WebAppInstalls.

Google has credited external researchers for reporting some of these issues. Hafiizh received a $1,500 reward for reporting CVE-2026-91724, a use-after-free issue in Input.

In contrast, Jihyeon Jeong from Seoul National University’s Compsec Lab received $1,000 for discovering CVE-2026-91728, an integer-overflow vulnerability in V8. Rewards for several other reports are still listed as TBD.

Users are advised to enable Chrome’s automatic updater to install the latest Stable build and to restart the browser to complete the update.

Enterprise administrators should verify deployment across their fleets using endpoint-management and browser-management consoles, especially on systems that regularly handle untrusted links, documents, web applications, or external email content.

Google said technical details and bug links may remain restricted until most users have updated. The company also credited its internal use of memory-safety and fuzzing technologies, including AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL, for helping to identify security defects before they could be widely exploited.

CVE Details

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC