Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones
Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.
58
Vulnerability3 · 2 reads
CVE-2026-91720
Out-of-Sandbox Memory Read via Uninitialized ANGLE Resource in Google Chrome
- CVSS 3.1
- 4.7 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-91720 is an uninitialized resource flaw (CWE-908) in ANGLE, the graphics translation layer Google Chrome uses to render WebGL and GPU-accelerated content. A remote attacker triggers the bug by luring a victim to a crafted HTML page, which causes ANGLE to handle uninitialized data in a way that allows the attacker to read memory outside the browser's sandbox. Successful exploitation yields an information disclosure across the sandbox boundary; Chromium rates the issue High severity because it undermines the sandbox that confines renderer compromises, even though the CVSS 3.1 base score is 4.7 (medium) given the required user interaction. All Google Chrome versions prior to 153.0.8010.47 are affected, with the fix shipping in the Chrome 153 stable update that resolved 42 security flaws. No public proof of concept exists, the CVE is not on CISA's Known Exploited Vulnerabilities list, and no exploitation in the wild has been reported.
What to do: Update Google Chrome to version 153.0.8010.47 or later immediately, verifying via Help > About Chrome or chrome://settings/help. Enterprises should confirm their managed fleets have the patched version pushed and that auto-update policies are enforced. Because ANGLE is shared Chromium code, users of Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and Electron apps should also apply their vendors' latest builds once available.
| Product | Affected |
|---|---|
| Google Chrome (ANGLE graphics translation layer) | < 153.0.8010.47 |
Estimated exposure
mass≈3 billion users (Chrome's global installed base across desktop and mobile) — Chrome is the world's dominant browser with roughly 3 billion users and about 65% market share, so any stable-channel flaw plausibly reaches billions of installations until auto-updates propagate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Uninitialized resource in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
In the news
2 storiesGoogle Chrome 153 Released With Fixes for 42 Security Vulnerabilities
Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.
55