Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones
Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.
58
Vulnerability2 · 2 reads
CVE-2026-91718
Use-After-Free in Google Chrome Core Allows Remote Code Execution
- CVSS 3.1
- 9.6 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-91718 is a use-after-free vulnerability in the Core component of Google Chrome that allows a remote attacker to execute arbitrary code outside the browser sandbox via a specially crafted HTML page. The flaw exists in Chrome versions prior to 153.0.8010.47 and is rated High severity by the Chromium security team. An attacker who successfully exploits this vulnerability gains the ability to run arbitrary code on the victim's system, potentially bypassing Chrome's sandbox protections. All users of Google Chrome who have not yet updated to version 153.0.8010.47 or later are affected. No public proof-of-concept or known in-the-wild exploitation has been reported at this time.
What to do: Update Google Chrome to version 153.0.8010.47 or later immediately via Chrome Settings > About Chrome. Enterprise administrators should verify that managed deployments are pulling the latest stable channel update and consider using Chrome's auto-update policies to enforce rapid patching. Monitor for any future reports of in-the-wild exploitation, as use-after-free flaws in Chrome are frequently weaponized once details become public.
| Product | Affected |
|---|---|
| Google Chrome | prior to 153.0.8010.47 |
Estimated exposure
mass≈3 billion+ users (Chrome's global user base) — Google Chrome is the dominant web browser globally with an estimated 3+ billion users, though the population actually vulnerable is limited to those who have not yet updated to version 153.0.8010.47.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Use after free in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
In the news
2 storiesGoogle Chrome 153 Released With Fixes for 42 Security Vulnerabilities
Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.
55