Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones
Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.
58
CVE-2026-91733
Sandbox Escape via Skia State Validation Flaw in Google Chrome <153.0.8010.47
- CVSS 3.1
- 8.3 high
- EPSS
- <1%p25
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Google Chrome versions prior to 153.0.8010.47 contain an improper state validation flaw (CWE-754) in Skia, the browser's core 2D graphics rendering library. A remote attacker who has already compromised the renderer process — for example by chaining a separate renderer memory-corruption bug — can trigger the flaw through a crafted HTML page and read memory outside the Chrome sandbox. This provides a sandbox-escape primitive that, when combined with an initial renderer exploit, breaks Chrome's core security boundary and can expose sensitive process memory. All users running Chrome older than 153.0.8010.47 are affected. Google rates the severity High, and there is currently no known public proof of concept and no indication of in-the-wild exploitation.
What to do: Update Google Chrome to version 153.0.8010.47 or later immediately — desktop Chrome normally self-updates, so verify the running version at chrome://settings/help. Enterprise admins should confirm the patched build has rolled out fleet-wide and check that update-deferral or pinning policies are not holding devices on older versions. Because this bug is a sandbox-escape stage typically chained with a separate renderer exploit, also update Chromium-based browsers (Edge, Brave, Opera, etc.) as vendors ship downstream patches.
| Product | Affected |
|---|---|
| Google Chrome | prior to 153.0.8010.47 (< 153.0.8010.47) |
Estimated exposure
mass≈3 billion+ Chrome users worldwide — Chrome holds roughly two-thirds of the global browser market across desktop and mobile, giving an installed base in the billions, and essentially all of those installations were running a vulnerable version until the 153.0.8010.47 fix…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
In the news
2 storiesGoogle Chrome 153 Released With Fixes for 42 Security Vulnerabilities
Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.
55