Chrome, Firefox Updates Patch 115 Vulnerabilities

CVE-2026-91721 is a critical use-after-free flaw (CWE-416) in Chrome's Internals component affecting versions prior to 153.0.8010.47. A remote attacker triggers it by convincing a user to visit a crafted HTML page, which corrupts freed memory and can lead to arbitrary code execution outside the browser sandbox — a full compromise of the victim's machine rather than a sandboxed renderer compromise. The issue carries a CVSS 3.1 score of 8.8 (network vector, low complexity, no privileges, but user interaction required) and was rated Critical by the Chromium security team. All users of Google Chrome on any platform who have not updated to 153.0.8010.47 or later are affected, with downstream Chromium-based browsers potentially inheriting the flaw. No public proof of concept is known and the vulnerability is not listed in CISA's KEV catalog, so no in-the-wild exploitation has been confirmed at this time.

Do: Update Google Chrome to version 153.0.8010.47 or later immediately (Help > About Google Chrome, or via enterprise policy), and verify the version across managed fleets. Organizations running Chromium-derived browsers (Edge, Brave, Opera, Vivaldi, etc.) should apply those vendors' equivalent updates once released, since they inherit the vulnerable Blink/V8 codebase. Because exploitation requires only a user clicking a crafted link, consider reinforcing phishing defenses and enabling Chrome's automatic update policies for managed devices.

CVE-2026-91726 is an out-of-bounds read (CWE-125) in the WebGL implementation of Google Chrome on Android, fixed in version 153.0.8010.47. A remote attacker triggers the flaw by convincing a user to visit a crafted HTML page, which causes the browser to read memory outside of Chrome's sandbox. Although the CVSS 3.1 base score is 4.7 (medium) due to the requirement for user interaction and limited confidentiality-only impact, Google's Chromium team rates it Critical because defeating the sandbox boundary undermines Chrome's core security model. Only Chrome on Android versions prior to 153.0.8010.47 are affected; desktop and other-platform Chrome builds are not in scope per the advisory. There is no known public proof of concept, the CVE is not on CISA's KEV list, and no exploitation in the wild has been reported; the flaw was patched as one of three critical issues in the Chrome 153 update.

Do: Update Chrome on Android to 153.0.8010.47 or later immediately (Settings > About Chrome, or via Google Play) — the fix is included in the Chrome 153 release. For managed Android fleets, verify the deployed Chrome version and push the update rather than waiting for the automatic rollout. Because exploitation only requires a user to visit a malicious page, no special network mitigation exists beyond patching; investigate any reports of sensitive process memory disclosures on unpatched devices.

CVE-2026-91749 is a critical-severity use-after-free vulnerability (CWE-416) in the Workers component of Google Chrome, fixed in version 153.0.8010.47. A remote attacker triggers the flaw by luring a victim to a crafted HTML page, where a freed memory object in the Worker implementation is improperly reused, potentially allowing arbitrary code execution outside the browser sandbox. Successful exploitation means a malicious webpage can escape Chrome's sandbox and run code on the underlying operating system with the user's privileges, effectively fully compromising the workstation. All Chrome installations prior to 153.0.8010.47 are affected on every platform, and third-party Chromium-based browsers inherit the vulnerable engine code until they ship the upstream fix. No public proof-of-concept is known and the bug is not on CISA's Known Exploited Vulnerabilities catalog, but the Critical severity rating indicates Google judged the potential impact to be severe.

Do: Update Google Chrome to version 153.0.8010.47 or later immediately and verify via chrome://settings/help; enterprises should confirm update policies have applied the fix fleet-wide. Because exploitation requires only that a victim visit a crafted page, defenders should monitor EDR telemetry for renderer/worker-process crashes or unexpected child processes spawned by Chrome until the fleet is fully patched. Administrators of Chromium-based browsers that bundle the same engine (e.g., Edge, Brave, Vivaldi, Opera) should deploy those vendors' equivalent updates as soon as they are released.