Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones
Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.
58
CVE-2026-91727
Chrome on macOS: Extension Reference Resolution Flaw Enables Sandbox Escape
- CVSS 3.1
- 8.1 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An incorrect reference resolution flaw (CWE-706) in the Extensions component of Google Chrome on macOS, fixed in version 153.0.8010.47, permits a sandbox escape. Exploitation requires a local attacker who has already compromised Chrome's renderer process — for example by chaining a malicious webpage with a separate renderer bug — and then abuses the flaw via a local program to execute arbitrary code outside the sandbox. Successful exploitation gives code execution with the logged-in user's privileges, with high impact to confidentiality, integrity, and availability (CVSS 3.1: 8.1, High). Per the advisory, only Chrome on macOS is affected, in versions prior to 153.0.8010.47. No public proof-of-concept is known, the CVE is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.
What to do: Update Chrome on macOS to 153.0.8010.47 or later immediately (Chrome menu > Help > About Google Chrome) and verify that enterprise policy is not blocking auto-updates on managed Mac fleets. Check whether Chromium-based derivatives (Edge, Brave, Opera, and similar) have shipped the corresponding backported fix, since they inherit upstream extension code. Because exploitation requires a chained renderer compromise plus local access, prioritize high-value or frequently-targeted users and ensure monitoring for renderer-process crashes and suspicious child-process behavior is in place.
| Product | Affected |
|---|---|
| Google Chrome (macOS) | Prior to 153.0.8010.47 (< 153.0.8010.47) |
Estimated exposure
massTens of millions of users (roughly 50-100M Chrome-on-macOS installations before auto-update closes the gap) — Estimated from Apple's ~100M+ active Mac installed base combined with Chrome's majority share of desktop browsing; Chrome's aggressive auto-update typically patches the vast majority of users within days, so the truly unpatched pool…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
In the news
2 storiesGoogle Chrome 153 Released With Fixes for 42 Security Vulnerabilities
Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.
55