Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones
Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.
58
Vulnerability3 · 2 reads
CVE-2026-91740
Cross-Origin Data Leak via Uninitialized Resource in Skia in Google Chrome
- CVSS 3.1
- 4.3 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-91740 is an uninitialized resource flaw (CWE-908) in the Skia graphics library used by Google Chrome, fixed in the Chrome 153 stable update (version 153.0.8010.47) that resolved 42 security flaws. A remote attacker triggers the bug by luring a victim to open a crafted HTML page, which causes Skia to expose uninitialized data during page rendering. Successful exploitation lets the attacker read cross-origin data from the victim's browser session, violating the browser's same-origin protections and potentially exposing content from other websites the victim has visited. All users running Chrome versions prior to 153.0.8010.47 are affected, though Chrome's auto-update mechanism typically narrows the unpatched window. Chromium rates the issue High severity (CVSS 3.1: 4.3, medium, user interaction required); it is not in the CISA KEV catalog, and no public proof of concept or in-the-wild exploitation is known.
What to do: Update Google Chrome to version 153.0.8010.47 or later on all desktops and verify at chrome://settings/help. Enterprise and education admins should confirm their update policies have pushed the fixed build and expedite any devices lagging behind. Users of other Chromium-based browsers that bundle Skia (e.g., Edge, Brave, Opera) should also apply the latest updates from those vendors, since the underlying engine flaw is inherited.
| Product | Affected |
|---|---|
| Google Chrome | prior to 153.0.8010.47 (< 153.0.8010.47) |
Estimated exposure
mass≈3 billion+ Chrome users globally; likely tens to hundreds of millions of unpatched installs in the days following release — Chrome holds roughly 60-65% of the global browser market across an estimated 5 billion internet users, so the entire install base was exposed before auto-updates rolled out.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
In the news
2 storiesGoogle Chrome 153 Released With Fixes for 42 Security Vulnerabilities
Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.
55