Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones
Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.
58
CVE-2026-91735
Sandbox Escape via Incorrect WebUI Authorization in Google Chrome (Fixed in 153.0.8010.47)
- CVSS 3.1
- 8.3 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Google Chrome prior to 153.0.8010.47 contains an incorrect authorization flaw (CWE-863) in its WebUI, the privileged chrome:// internal-page component. A remote attacker who has already compromised the renderer process — typically by first exploiting a separate renderer bug delivered via a crafted HTML page the victim visits — can abuse this flaw to execute arbitrary code outside the browser sandbox. Successful escape grants code execution with the browser process's full privileges on the host system, effectively defeating Chrome's core sandboxing defense. All users running Chrome versions older than 153.0.8010.47 are affected. No public proof of concept exists and the issue is not on CISA's Known Exploited Vulnerabilities list, but Google rates it High severity (CVSS 3.1: 8.3).
What to do: Update Chrome to 153.0.8010.47 or later immediately; Chrome auto-updates by default, but users should verify at chrome://settings/help and restart the browser. Enterprise administrators should enforce the patched version floor via group policy or device management update controls. Because exploitation requires chaining a renderer compromise with this sandbox escape, prompt patching closes the escape route even if a separate renderer bug is being leveraged.
| Product | Affected |
|---|---|
| Google Chrome | prior to 153.0.8010.47 |
Estimated exposure
mass≈3 billion+ Chrome users potentially affected until updated past 153.0.8010.47 — Chrome holds roughly 65% of the global browser market with an installed base of about 3 billion users, and every installation below the fixed version was vulnerable prior to the update's rollout.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
In the news
2 storiesGoogle Chrome 153 Released With Fixes for 42 Security Vulnerabilities
Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.
55