Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones
Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.
58
Vulnerability2 · 1 read
CVE-2026-91729
Use-After-Free in Google Chrome DigitalCredentials Enables Sandbox Escape
- CVSS 3.1
- 9.6 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-91729 is a use-after-free memory corruption flaw (CWE-416) in the DigitalCredentials component of Google Chrome, fixed in version 153.0.8010.47. A remote attacker triggers it by using social engineering to lure a victim to a crafted HTML page that causes the browser to access freed memory in that component. Successful exploitation allows the attacker to execute arbitrary code outside Chrome's sandbox, a capability Chromium's security team rates as High severity. All users running Chrome versions earlier than 153.0.8010.47 are affected. No public proof-of-concept is known, the flaw is not on CISA's Known Exploited Vulnerabilities catalog, and there is no evidence of exploitation in the wild.
What to do: Update Google Chrome to version 153.0.8010.47 or later immediately; the fix ships in the Chrome 153 stable release, which resolved 42 security flaws. Enterprise and IT admins should verify that auto-update has applied the new version across managed fleets (check Help > About or chrome://version on endpoints). Chromium-derived browsers such as Edge, Brave, and Opera generally inherit this component, so apply their corresponding security updates as vendors release them.
| Product | Affected |
|---|---|
| Google Chrome | prior to 153.0.8010.47 (< 153.0.8010.47) |
Estimated exposure
mass≈3 billion users (Chrome's global installed base before patch rollout) — Chrome holds roughly two-thirds of the global browser market across desktop and mobile, so virtually every unpatched Chrome installation was reachable through a malicious web page.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
In the news
2 storiesGoogle Chrome 153 Released With Fixes for 42 Security Vulnerabilities
Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.
55