Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones
Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.
58
CVE-2026-91717
Missing Authorization in Google Chrome on Android Exposes Data to Local Apps
- CVSS 3.1
- 5.1 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Google Chrome on Android prior to version 153.0.8010.47 contains a missing authorization flaw (CWE-862) that allows a malicious app co-installed on the same device to obtain sensitive Chrome information. The attack is local, requires no privileges or user interaction, and has high confidentiality impact only, though the CVSS 3.1 score of 5.1 (AV:L/AC:H) indicates exploitation is non-trivial; Chromium rated the issue High severity. All Chrome on Android installations running versions older than 153.0.8010.47 are affected, with the fix shipping in the Chrome 153 stable release that resolved 42 security flaws. No public proof of concept is known, the CVE is not on the CISA Known Exploited Vulnerabilities list, and no in-the-wild exploitation has been reported.
What to do: Update Chrome on Android to 153.0.8010.47 or later; Play Store auto-update typically delivers this within days, so verify under Manage apps & device on any device handling sensitive data. For managed Android fleets, enforce a minimum Chrome version of 153.0.8010.47 through device policy. Since exploitation requires a co-installed malicious app, also restrict sideloading and untrusted app sources as a defense-in-depth measure.
| Product | Affected |
|---|---|
| Google Chrome on Android | prior to 153.0.8010.47 |
Estimated exposure
masson the order of 2-3 billion devices (Chrome on Android shows 10B+ Google Play installs and roughly two-thirds of mobile browser usage) — Chrome is the pre-installed default browser on the vast majority of Android devices worldwide, so the pre-patch install base is measured in the billions, though Google Play auto-updates narrow the vulnerable window over days.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: High)
In the news
2 storiesGoogle Chrome 153 Released With Fixes for 42 Security Vulnerabilities
Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.
55