Google has released Chrome version 153 to the Stable channel for desktop, addressing 42 security vulnerabilities, including three critical-severity flaws affecting WebGL, Chrome internals, and Workers.
This update is being rolled out as version 153.0.8010.47/48 for Windows and macOS, and as version 153.0.8010.47 for Linux.
The release includes a wide range of memory-safety, authorization, race-condition, and type-confusion flaws across core browser components.
Although Google’s bulletin does not indicate that any of the vulnerabilities are currently being exploited in the wild, the critical use-after-free and out-of-bounds read issues underscore the importance of prompt patching for consumers, enterprises, and managed-browser deployments.
The most severe issue is CVE-2026-91726, an out-of-bounds read vulnerability in WebGL, which Google reported internally on September 3. This flaw arises from improper bounds handling in graphics-processing paths.
It could disclose information or help compromise the browser process if attackers can trick a victim process into loading harmful web content.
Chrome 153 also resolves CVE-2026-91721, a use-after-free flaw in Internals, and CVE-2026-91749, another use-after-free vulnerability in Workers.
Use-after-free bugs occur when software continues to access memory after it has been released; in browsers, such vulnerabilities are particularly critical as they can sometimes be exploited to execute code or escape from sandboxed environments.
Twenty-eight of the fixes are classified as high severity. These include use-after-free vulnerabilities in components such as Input, Skia, DOM, Core, Auth, PDF, DigitalCredentials, WebAppInstalls, and V8; an integer overflow in the V8 JavaScript engine; and an out-of-bounds write in ServiceWorker.
Several fixes impact web-facing features that organizations commonly enable by default, including ServiceWorker, CacheStorage, WebUI, extensions, network components, ANGLE, and the PDF renderer.
Notable authorization-related vulnerabilities were addressed in Core, Extensions, WebUI, and Android functionalities. Google also fixed race conditions in Core, PlatformIntegration, Extensions, Network, and WebAppInstalls.
Google has credited external researchers for reporting some of these issues. Hafiizh received a $1,500 reward for reporting CVE-2026-91724, a use-after-free issue in Input.
In contrast, Jihyeon Jeong from Seoul National University’s Compsec Lab received $1,000 for discovering CVE-2026-91728, an integer-overflow vulnerability in V8. Rewards for several other reports are still listed as TBD.
Users are advised to enable Chrome’s automatic updater to install the latest Stable build and to restart the browser to complete the update.
Enterprise administrators should verify deployment across their fleets using endpoint-management and browser-management consoles, especially on systems that regularly handle untrusted links, documents, web applications, or external email content.
Google said technical details and bug links may remain restricted until most users have updated. The company also credited its internal use of memory-safety and fuzzing technologies, including AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL, for helping to identify security defects before they could be widely exploited.
CVE Details
| CVE | Severity | Vulnerability / Component | Reward | Reporter | Reported |
|---|---|---|---|---|---|
| CVE-2026-91726 | Critical | Out-of-bounds read in WebGL | N/A | Sep. 3, 2026 | |
| CVE-2026-91721 | Critical | Use-after-free in Internals | TBD | xinyang | Sep. 4, 2026 |
| CVE-2026-91749 | Critical | Use-after-free in Workers | TBD | WinD39 – Huynh Dinh Vu | Sep. 8, 2026 |
| CVE-2026-91724 | High | Use-after-free in Input | $1,500 | Hafiizh | Aug. 25, 2026 |
| CVE-2026-91728 | High | Integer overflow in V8 | $1,000 | Jihyeon Jeong, Compsec Lab / Seoul National University | Sep. 3, 2026 |
| CVE-2026-91734 | High | Incorrect authorization in Core | N/A | May 26, 2026 | |
| CVE-2026-91727 | High | Incorrect reference resolution in Extensions | N/A | May 26, 2026 | |
| CVE-2026-91743 | High | Race condition in Core | N/A | May 27, 2026 | |
| CVE-2026-91744 | High | Race condition in PlatformIntegration | N/A | Jun. 4, 2026 | |
| CVE-2026-91712 | High | Race condition in Extensions | N/A | Jun. 8, 2026 | |
| CVE-2026-91748 | High | Race condition in Extensions | N/A | Jun. 9, 2026 | |
| CVE-2026-91720 | High | Uninitialized resource in ANGLE | N/A | Jun. 13, 2026 | |
| CVE-2026-91731 | High | Type confusion in Compositing | N/A | Jun. 13, 2026 | |
| CVE-2026-91747 | High | Use-after-free in Skia | N/A | Jul. 28, 2026 | |
| CVE-2026-91733 | High | Improper state validation in Skia | N/A | Jul. 28, 2026 | |
| CVE-2026-91741 | High | Type confusion in CacheStorage | TBD | Salvatore Gulizia (Serotav) | Aug. 14, 2026 |
| CVE-2026-91709 | High | Type confusion in ServiceWorker | TBD | Jihyeon Jeong, Compsec Lab / Seoul National University | Aug. 17, 2026 |
| CVE-2026-91717 | High | Missing authorization in Android | TBD | jodyritonga | Aug. 20, 2026 |
| CVE-2026-91735 | High | Incorrect authorization in WebUI | N/A | Aug. 25, 2026 | |
| CVE-2026-91708 | High | Race condition in Network | N/A | Aug. 26, 2026 | |
| CVE-2026-91736 | High | Use-after-free in DOM | N/A | Aug. 26, 2026 | |
| CVE-2026-91740 | High | Uninitialized resource in Skia | N/A | Aug. 26, 2026 | |
| CVE-2026-91710 | High | Use-after-free in WebAppInstalls | N/A | Aug. 26, 2026 | |
| CVE-2026-91718 | High | Use-after-free in Core | N/A | Aug. 26, 2026 | |
| CVE-2026-91716 | High | Use-after-free in Auth | N/A | Aug. 29, 2026 | |
| CVE-2026-91746 | High | Integer overflow in Compositing | N/A | Sep. 2, 2026 | |
| CVE-2026-91729 | High | Use-after-free in DigitalCredentials | TBD | sean geofrey | Sep. 4, 2026 |
| CVE-2026-91737 | High | Use-after-free in PDF | TBD | SeungMyung Lee and Siung kim | Sep. 6, 2026 |
| CVE-2026-91711 | High | Out-of-bounds write in ServiceWorker | TBD | Cristian Di Nicola (@crih.exe) | Sep. 7, 2026 |
| CVE-2026-91715 | High | Type confusion in ServiceWorker | TBD | Cristian Di Nicola (@crih.exe) | Sep. 7, 2026 |
| CVE-2026-91745 | High | Use-after-free in V8 | N/A | Sep. 8, 2026 | |
| CVE-2026-91723 | Medium | Race condition in WebAppInstalls | TBD | Luan Herrera (@lbherrera_) | Jan. 7, 2026 |
| CVE-2026-91732 | Medium | Missing authorization in AppManifest | TBD | pakhunov.anton.n | May 8, 2026 |
| CVE-2026-91742 | Medium | Confused deputy in PriceTracking | N/A | May 16, 2026 | |
| CVE-2026-91714 | Medium | Observable discrepancy in Fonts | N/A | May 29, 2026 | |
| CVE-2026-91725 | Medium | Observable discrepancy in CSS | N/A | May 29, 2026 | |
| CVE-2026-91739 | Medium | Missing authorization in Transactions Platform | N/A | Jun. 9, 2026 | |
| CVE-2026-91713 | Medium | Missing authorization in Browser | N/A | Jun. 14, 2026 | |
| CVE-2026-91738 | Medium | Improper input validation in ANGLE | N/A | Jul. 19, 2026 | |
| CVE-2026-91730 | Medium | Incomplete cleanup in GetUserMedia | TBD | Keita Sode and Daisuke Hatakeyama, SYZD Research | Aug. 7, 2026 |
| CVE-2026-91722 | Medium | Use-after-free in Input | TBD | TIENPA | Aug. 31, 2026 |
| CVE-2026-91719 | Low | Code injection in XML | TBD | Zabith Mohammed (@nmzabith) | Aug. 3, 2026 |
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…