Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones
Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.
58
Vulnerability3 · 2 reads
CVE-2026-91728
Integer Overflow in V8 Enables Sandbox Code Execution in Google Chrome
- CVSS 3.1
- 9.6 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-91728 is an integer overflow (CWE-190) in the V8 JavaScript engine used by Google Chrome, fixed in version 153.0.8010.47. The flaw is triggered when a user visits a crafted HTML page, where malformed JavaScript causes an integer overflow leading to memory corruption in the renderer. Successful exploitation allows a remote attacker to execute arbitrary code inside the browser sandbox, and Chromium rates the severity High; the CVSS 3.1 score of 9.6 reflects high impact to confidentiality, integrity, and availability if chained with a separate sandbox escape. All users running Chrome versions prior to 153.0.8010.47 on any platform are affected. No public proof-of-concept is known, the flaw is not on CISA's KEV list, and no exploitation in the wild has been reported.
What to do: Update Google Chrome to version 153.0.8010.47 or later immediately and verify via Help > About Chrome; enterprises should confirm auto-update policies are not delaying rollout. Because the flaw resides in V8, users of other Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should apply those vendors' updates as the fix propagates. Exploitation requires user interaction with a malicious page, so blocking known-bad links adds defense-in-depth, but patching is the definitive mitigation.
| Product | Affected |
|---|---|
| Google Chrome | prior to 153.0.8010.47 (< 153.0.8010.47) |
Estimated exposure
mass≈1–3 billion Chrome installations; likely tens to hundreds of millions unpatched at any given moment — Chrome holds roughly 60–65% of the global browser market across desktop and mobile with an installed base in the billions, so even a partial lag in auto-updates leaves a very large attackable population.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
In the news
2 storiesGoogle Chrome 153 Released With Fixes for 42 Security Vulnerabilities
Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.
55