Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones
Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.
58
CVE-2026-91741
Type Confusion in Chrome CacheStorage Allows Sandbox RCE via Malicious Webpage
- CVSS 3.1
- 8.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-91741 is a type confusion vulnerability (CWE-843) in the CacheStorage component of Google Chrome, fixed in version 153.0.8010.47. A remote attacker can trigger the flaw by convincing a user to visit a crafted HTML page, which causes the browser to misinterpret an object's type and leads to memory corruption. Successful exploitation allows the attacker to execute arbitrary code inside Chrome's renderer sandbox, with the CVSS 3.1 base score of 8.8 reflecting full impact to confidentiality, integrity, and availability within the browser context. All users running Chrome versions older than 153.0.8010.47 are affected, which encompasses a substantial share of the browser's user base until updates propagate. As of now, the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, no public proof of concept is known, and no in-the-wild exploitation has been reported.
What to do: Update Google Chrome to version 153.0.8010.47 or later immediately; desktop Chrome normally auto-updates, but users should verify via 'Help > About Google Chrome' or chrome://settings/help. Enterprise administrators should push the patched version via update policy (e.g., the RelaunchNotification and RolloutStrategy Chrome enterprise policies) and confirm fleet-wide compliance. Defenders should also monitor for users of Chromium-based derivatives (Edge, Brave, Opera, Vivaldi) and apply their corresponding patched builds, since they inherit the underlying CacheStorage code.
| Product | Affected |
|---|---|
| Google Chrome | < 153.0.8010.47 |
Estimated exposure
mass≈2–3 billion users (Chrome holds roughly 65% of global browser market share across desktop and mobile) — Estimated from Chrome's dominant global browser market share; the number of users still on pre-153.0.8010.47 builds will decline as the auto-update rollout completes but initially represents the majority of Chrome installations.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
In the news
2 storiesGoogle Chrome 153 Released With Fixes for 42 Security Vulnerabilities
Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.
55