Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones
Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.
58
CVE-2026-91737
Use-After-Free in Google Chrome PDF Handling Enables Sandboxed RCE
- CVSS 3.1
- 8.8 high
- EPSS
- <1%p28
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-91737 is a use-after-free vulnerability (CWE-416) in the PDF handling functionality of Google Chrome, fixed in version 153.0.8010.47. A remote attacker can trigger the flaw by convincing a user to visit a crafted HTML page, which corrupts memory during PDF processing and allows arbitrary code execution inside the browser's sandbox. Chromium rates the severity High, meaning it is a strong candidate for use in exploit chains, particularly when combined with a separate sandbox-escape bug. All users running Chrome versions older than 153.0.8010.47 on any platform are affected, since PDF rendering is a core browser feature. No public proof of concept exists, the flaw is not on the CISA Known Exploited Vulnerabilities list, and no in-the-wild exploitation has been reported.
What to do: Update Google Chrome to version 153.0.8010.47 or later immediately; users can verify their version at chrome://settings/help, where updates apply automatically on restart. Enterprise administrators should confirm managed devices are on 153.0.8010.47 or later and expedite rollout, since the fix shipped as part of the Chrome 153 stable channel update. Because this bug only yields code execution inside the sandbox, defenders should also ensure sandboxing remains enabled and keep an eye out for follow-on sandbox-escape bugs that could turn this into a full compromise.
| Product | Affected |
|---|---|
| Google Chrome | < 153.0.8010.47 |
Estimated exposure
massBillions of users potentially exposed (Chrome has roughly 3 billion+ installations worldwide) — Chrome is the dominant browser globally with an estimated 3 billion-plus users and roughly two-thirds of desktop browser market share, so essentially every unpatched installation is in scope.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
In the news
2 storiesGoogle Chrome 153 Released With Fixes for 42 Security Vulnerabilities
Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.
55