Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones
Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.
58
Vulnerability3 · 1 read
CVE-2026-91716
Use-After-Free in Google Chrome Auth Enables Sandbox-Escape RCE
- CVSS 3.1
- 9.6 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-91716 is a use-after-free vulnerability (CWE-416) in the Auth component of Google Chrome that was fixed in version 153.0.8010.47. A remote attacker can exploit it by tricking a victim into visiting a crafted HTML page, which triggers the memory-corruption flaw during authentication handling. Successful exploitation allows the attacker to execute arbitrary code outside the browser's sandbox, meaning full compromise of the underlying user account rather than confinement to the sandboxed renderer. All users running Chrome versions prior to 153.0.8010.47 on any supported desktop platform are affected. Google rates the severity High; there is no known public proof-of-concept, it is not in the CISA Known Exploited Vulnerabilities catalog, and no exploitation in the wild has been reported at this time.
What to do: Update Google Chrome to version 153.0.8010.47 or later immediately; users can confirm their version via chrome://settings/help. Enterprise administrators should verify that Chrome's auto-update mechanism is enabled and functioning across managed fleets, and push the update to any devices lagging behind. Because the flaw lies in Chromium's Auth component, users of other Chromium-based browsers should also apply their vendors' updates as they become available, since this Chrome CVE version number does not map directly to those products.
| Product | Affected |
|---|---|
| Google Chrome | < 153.0.8010.47 |
Estimated exposure
massUp to ≈3 billion Chrome users worldwide prior to patching, shrinking rapidly as auto-update rolls out — Chrome holds roughly 60-65% of the global browser market with an install base commonly estimated at around 3 billion users across desktop and mobile, nearly all of whom were on a vulnerable version until the 153.0.8010.47 update reached…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
In the news
2 storiesGoogle Chrome 153 Released With Fixes for 42 Security Vulnerabilities
Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.
55