Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones
Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.
58
CVE-2026-91715
Type Confusion in Chrome ServiceWorker Allows Sandboxed RCE via Crafted Web Page
- CVSS 3.1
- 8.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-91715 is a type confusion vulnerability (CWE-843) in the ServiceWorker implementation of Google Chrome, fixed in version 153.0.8010.47. A remote attacker triggers the flaw by convincing a victim to load a crafted HTML page that manipulates the ServiceWorker code path, causing the browser to treat an object as an incompatible type. Successful exploitation yields arbitrary code execution inside Chrome's renderer sandbox, which Chromium rates as High severity since sandboxed code execution is a strong precursor to full compromise when chained with a separate sandbox escape. All users of Google Chrome versions prior to 153.0.8010.47 are affected; the fix shipped in the Chrome 153 stable update that patched 42 security flaws, including three rated critical. No public proof-of-concept exists, the issue is not on the CISA Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported.
What to do: Update Google Chrome to 153.0.8010.47 or later immediately; verify by checking chrome://settings/help. Administrators of Chromium-based derivatives (Edge, Brave, Opera, Vivaldi, and embedded Chromium components) should apply their vendors' corresponding security updates once available. Because the attack vector is a crafted web page with no practical configuration workaround, patching is the only reliable mitigation — ensure enterprise auto-update policies are enabled and prioritize this alongside the other flaws fixed in Chrome 153.
| Product | Affected |
|---|---|
| Google Chrome | prior to 153.0.8010.47 |
Estimated exposure
mass≈3 billion users (Chrome holds roughly 65% of global browser market share across desktop and mobile) — Chrome is the dominant browser worldwide with on the order of 3 billion active users, so essentially every unpatched installation is potentially exposed simply by browsing to a malicious page.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
In the news
2 storiesGoogle Chrome 153 Released With Fixes for 42 Security Vulnerabilities
Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.
55