Google has released Chrome 153 to the Stable channel, addressing 42 security vulnerabilities across the browser’s rendering, JavaScript, graphics, extension, authentication, and platform components.
The update is rolling out as version 153.0.8010.47/.48 for Windows and macOS, and version 153.0.8010.47 for Linux.
The September 15, 2026 release contains three critical-severity flaws, including an out-of-bounds read in WebGL and two use-after-free vulnerabilities affecting Chrome Internals and Workers.
Google Chrome 153 Fixes 42 Security Flaws
The most severe issue, tracked as CVE-2026-91726, is an out-of-bounds read vulnerability in WebGL. WebGL exposes GPU-accelerated graphics capabilities to web content, making memory-safety defects in this component particularly important in browser attack scenarios.
A successful exploit could potentially allow a malicious website to trigger unexpected memory access within the browser’s graphics-processing path.
Chrome 153 also resolves CVE-2026-91721, a use-after-free flaw in Internals, and CVE-2026-91749, a use-after-free issue in Workers. Use-after-free bugs occur when software continues accessing memory after releasing it.
In browsers, attackers commonly attempt to exploit these defects through crafted web content to cause crashes, corrupt memory, or potentially achieve code execution within a compromised browser process.
Google did not state that any of the 42 vulnerabilities are being actively exploited in the wild. However, multiple critical and high-severity memory-corruption flaws make prompt patching essential for enterprise and individual users.
The update remediates 28 high-severity vulnerabilities. These include use-after-free defects in Input, Skia, DOM, V8, PDF, Core, Auth, DigitalCredentials, and WebAppInstalls; an integer overflow in the V8 JavaScript engine; and an out-of-bounds write in ServiceWorker.
Other high-impact fixes address type-confusion vulnerabilities in Compositing, CacheStorage, and ServiceWorker. Type-confusion flaws can allow an attacker to make a program treat an object as an incompatible type, which may lead to memory corruption.
Chrome 153 additionally patches race conditions in Core, Extensions, Network, and PlatformIntegration, as well as authorization weaknesses affecting Core, WebUI, Android, and extensions.
Notably, V8 remains a high-value target because it processes JavaScript delivered by websites. The V8 integer overflow tracked as CVE-2026-91728 and the V8 use-after-free issue CVE-2026-91745 should be prioritized by organizations that rely on Chrome in managed environments.
Google credited internal researchers and external security researchers for reporting the flaws, with listed rewards of $1,500 for CVE-2026-91724 and $1,000 for CVE-2026-91728.
| CVE | Severity | Vulnerability | Affected Component |
|---|---|---|---|
| CVE-2026-91726 | Critical | Out-of-bounds read | WebGL |
| CVE-2026-91721 | Critical | Use-after-free | Internals |
| CVE-2026-91749 | Critical | Use-after-free | Workers |
| CVE-2026-91724 | High | Use-after-free | Input |
| CVE-2026-91728 | High | Integer overflow | V8 |
| CVE-2026-91734 | High | Incorrect authorization | Core |
| CVE-2026-91727 | High | Incorrect reference resolution | Extensions |
| CVE-2026-91743 | High | Race condition | Core |
| CVE-2026-91744 | High | Race condition | PlatformIntegration |
| CVE-2026-91712 | High | Race condition | Extensions |
| CVE-2026-91748 | High | Race condition | Extensions |
| CVE-2026-91720 | High | Uninitialized resource | ANGLE |
| CVE-2026-91731 | High | Type confusion | Compositing |
| CVE-2026-91747 | High | Use-after-free | Skia |
| CVE-2026-91733 | High | Improper state validation | Skia |
| CVE-2026-91741 | High | Type confusion | CacheStorage |
| CVE-2026-91709 | High | Type confusion | ServiceWorker |
| CVE-2026-91717 | High | Missing authorization | Android |
| CVE-2026-91735 | High | Incorrect authorization | WebUI |
| CVE-2026-91708 | High | Race condition | Network |
| CVE-2026-91736 | High | Use-after-free | DOM |
| CVE-2026-91740 | High | Uninitialized resource | Skia |
| CVE-2026-91710 | High | Use-after-free | WebAppInstalls |
| CVE-2026-91718 | High | Use-after-free | Core |
| CVE-2026-91716 | High | Use-after-free | Auth |
| CVE-2026-91746 | High | Integer overflow | Compositing |
| CVE-2026-91729 | High | Use-after-free | DigitalCredentials |
| CVE-2026-91737 | High | Use-after-free | |
| CVE-2026-91711 | High | Out-of-bounds write | ServiceWorker |
| CVE-2026-91715 | High | Type confusion | ServiceWorker |
| CVE-2026-91745 | High | Use-after-free | V8 |
| CVE-2026-91723 | Medium | Race condition | WebAppInstalls |
| CVE-2026-91732 | Medium | Missing authorization | AppManifest |
| CVE-2026-91742 | Medium | Confused deputy | PriceTracking |
| CVE-2026-91714 | Medium | Observable discrepancy | Fonts |
| CVE-2026-91725 | Medium | Observable discrepancy | CSS |
| CVE-2026-91739 | Medium | Missing authorization | Transactions Platform |
| CVE-2026-91713 | Medium | Missing authorization | Browser |
| CVE-2026-91738 | Medium | Improper input validation | ANGLE |
| CVE-2026-91730 | Medium | Incomplete cleanup | GetUserMedia |
| CVE-2026-91722 | Medium | Use-after-free | Input |
| CVE-2026-91719 | Low | Code injection | XML |
Chrome normally updates automatically, but users should verify that their browser has received the fixed build. Navigate to chrome://settings/help to trigger an update check and relaunch the browser when prompted.
Administrators should use their endpoint-management platform to confirm deployment across Windows, macOS, and Linux fleets.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
