Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones
Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.
58
Vulnerability2 · 1 read
CVE-2026-91743
Sandbox Escape via Race Condition in Google Chrome Core
- CVSS 3.1
- 8.3 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-91743 is a race condition (CWE-367) in the Core component of Google Chrome in versions prior to 153.0.8010.47. The vulnerability is triggered when a victim visits a crafted HTML page, allowing a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the Chrome sandbox. In practice, this flaw serves as the second stage of a full browser compromise: an attacker would first need a separate renderer bug to gain code execution inside the sandbox, then use this race condition to escape it and run code with the user's full privileges. All users running Chrome older than 153.0.8010.47 on any platform are affected. Google rated the issue High severity (CVSS 8.3); there is no known public proof of concept, it is not on the CISA KEV list, and no in-the-wild exploitation has been reported.
What to do: Update Google Chrome to version 153.0.8010.47 or later immediately; desktop builds normally auto-update but a manual check via Help > About Google Chrome confirms the patch is applied. Enterprise and education administrators should verify their update policies (Chrome Browser Cloud Management or Group Policy) have pushed the fixed build to all managed endpoints, including VDI and shared workstation images. Because exploitation requires a prior renderer compromise, keeping Chrome fully patched on the latest stable channel significantly reduces the viability of any full exploit chain.
| Product | Affected |
|---|---|
| Google Chrome | < 153.0.8010.47 (all versions prior to 153.0.8010.47) |
Estimated exposure
mass≈3 billion users (Chrome holds roughly two-thirds of global browser market share; all unpatched installs affected) — Chrome is the world's dominant browser with an estimated 3+ billion users across desktop and mobile, and every installation not yet updated past 153.0.8010.47 is technically vulnerable.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Race condition in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
In the news
2 storiesGoogle Chrome 153 Released With Fixes for 42 Security Vulnerabilities
Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.
55