Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones
Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.
58
Vulnerability2 · 1 read
CVE-2026-91746
Integer Overflow in Google Chrome Compositing Leaks Cross-Origin Data
- CVSS 3.1
- 4.3 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-91746 is an integer overflow (CWE-190) in the Compositing component of Google Chrome, fixed in version 153.0.8010.47 as part of an update addressing 42 security flaws. It is triggered when a victim views a crafted HTML page, causing the compositing code to overflow an integer and enabling a remote attacker to obtain cross-origin data, violating the browser's same-origin policy. The practical impact is limited to information disclosure (confidentiality only, no code execution or integrity impact per the CVSS 3.1 vector, which requires user interaction and rates the issue 4.3 medium). All users running Chrome versions prior to 153.0.8010.47 are affected, which is effectively the majority of the installed base at the time of disclosure. There is no known public proof-of-concept, the flaw is not on the CISA Known Exploited Vulnerabilities list, and no in-the-wild exploitation has been reported.
What to do: Update Chrome to version 153.0.8010.47 or later immediately (Settings > About Chrome triggers the update check), and confirm the version after updating. Enterprise administrators should verify auto-update policies (e.g., the UpdateDefault policy) are set to force updates and monitor fleet compliance. Because exploitation requires the user to open a crafted page, user awareness of unsolicited links provides defense-in-depth, but patching is the primary mitigation.
| Product | Affected |
|---|---|
| Google Chrome | < 153.0.8010.47 |
Estimated exposure
mass≈3 billion users (roughly two-thirds of the global browser market) running unpatched Chrome at disclosure — Google Chrome is the dominant desktop and mobile browser worldwide, so any pre-update Chrome installation — the large majority of the user base in the days after release — is plausibly affected.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Integer overflow in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
In the news
2 storiesGoogle Chrome 153 Released With Fixes for 42 Security Vulnerabilities
Google shipped Chrome 153 to the Stable channel fixing 42 vulnerabilities, including three critical flaws in WebGL, Internals, and Workers; no exploitation reported.
55