Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones

CVE-2026-91708 is a time-of-check/time-of-use race condition (CWE-367) in the Network component of Google Chrome that allows a remote attacker who has already compromised the renderer process to obtain cross-origin data, breaking the browser's Same-Origin Policy. The attack is triggered when a victim loads a crafted HTML page, and the attacker gains the ability to read data belonging to other origins; Chromium's security team rated the bug High severity, while the standalone CVSS of 3.1 is low because exploitation requires user interaction, high attack complexity, and a pre-existing renderer compromise. All users running Chrome versions prior to 153.0.8010.47 are affected, with the fix shipped in the Chrome 153 update that resolved 42 security flaws. No public proof-of-concept exists, the CVE is not on CISA's KEV list, and there is no evidence of in-the-wild exploitation. In practice this flaw serves as a privilege-escalation step chained after a separate renderer-compromise bug rather than a standalone attack.

Do: Update Google Chrome to version 153.0.8010.47 or later and verify via Help > About Chrome or chrome://version, confirming that enterprise update policies are not delaying rollout. Because exploitation requires an already-compromised renderer, treat this as a chain component: prioritize prompt patching of renderer-layer vulnerabilities as well. Chromium-based browsers (Edge, Brave, Opera, Vivaldi) inherit the affected Network code, so apply their corresponding security updates when they ship.

CVE-2026-91709 is a type confusion vulnerability (CWE-843) in the ServiceWorker component of Google Chrome in versions prior to 153.0.8010.47. A remote attacker can trigger the flaw by luring a victim to a maliciously crafted HTML page, which requires user interaction such as clicking a link, reflected in the CVSS 3.1 score of 8.8. Successful exploitation allows the attacker to execute arbitrary code inside the Chrome renderer sandbox, which typically requires a separate sandbox escape for full host compromise but still constitutes a High-severity code execution primitive. All users running Google Chrome versions older than 153.0.8010.47 on any supported platform (Windows, macOS, Linux, Android) are affected. No public proof of concept is known and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, so exploitation is presumed none known at this time.

Do: Update Google Chrome to version 153.0.8010.47 or later immediately; users can trigger the update manually at chrome://settings/help. Enterprise administrators should verify fleet-wide patch status via Chrome Browser Cloud Management or Group Policy and accelerate the auto-update rollout window. Because exploitation requires only a victim visiting a crafted page, remind users that email and messaging links are the likely delivery vector, and treat any post-patch crash reports from ServiceWorker-heavy sites as worth investigating.

CVE-2026-91710 is a use-after-free vulnerability (CWE-416) in the WebAppInstalls component of Google Chrome in versions prior to 153.0.8010.47. A remote attacker can trigger the memory corruption by convincing a victim to visit a crafted HTML page, and successful exploitation yields arbitrary code execution outside the browser sandbox — meaning full compromise of the underlying operating system user account rather than a contained renderer crash. All desktop users running Chrome older than 153.0.8010.47 are affected, and the flaw is rated High severity by the Chromium security team. The fix shipped as part of the Chrome 153 stable update, which resolved 42 security flaws including three rated critical. No CVSS score has been assigned yet, the CVE is not on the CISA Known Exploited Vulnerabilities list, and no public proof of concept is known at this time.

Do: Update Google Chrome to version 153.0.8010.47 or later immediately; desktop auto-updates typically roll out within days, so verify via Help > About Chrome on all workstations. Enterprise and IT admins should confirm fleet-wide patch status through their management console and expedite updates for any lagging endpoints. Because exploitation is via crafted web pages, users on affected builds should avoid untrusted links until patched, and defenders should watch for post-patch reports of in-the-wild exploitation, which is common for Chrome use-after-free bugs.

CVE-2026-91711 is a high-severity out-of-bounds write (CWE-787) in the ServiceWorker component of Google Chrome, assigned by Google's Chrome CVE admin. A remote attacker triggers the flaw by luring a victim to a crafted HTML page that abuses the ServiceWorker subsystem to corrupt memory, allowing arbitrary code execution inside the Chrome sandbox. Successful exploitation gives the attacker code execution in the renderer process of the compromised tab, which typically still requires a separate sandbox escape for full host compromise. All users running Chrome versions prior to 153.0.8010.47 on any platform are affected; the fix shipped in the Chrome 153 stable update that resolved 42 security flaws, including 3 rated critical. No public proof of concept is known and the issue is not in CISA's Known Exploited Vulnerabilities catalog, so there is no evidence of in-the-wild exploitation at this time.

Do: Update Google Chrome to version 153.0.8010.47 or later immediately and verify the version via chrome://settings/help. Enterprise administrators should confirm managed devices have applied the update and consider accelerating the auto-update rollout given the potential for web-drive-by exploitation. Users of Chromium-derived browsers (e.g., Edge, Brave, Opera, Vivaldi) should also apply their vendors' updates as the underlying Chromium fix is backported.

CVE-2026-91712 is a time-of-check/time-of-use race condition (CWE-367) in the Extensions component of Google Chrome on macOS, fixed in version 153.0.8010.47. A remote attacker first compromises the browser's renderer process by luring a victim to a crafted HTML page, then exploits the race to potentially execute arbitrary code outside the Chrome sandbox. Successful exploitation gives the attacker code execution at the browser user's privilege level, defeating Chrome's core sandbox isolation, with high impact on confidentiality, integrity, and availability (CVSS 8.3). The attack requires user interaction and high attack complexity because it depends on reliably winning the race, and it presupposes an initial renderer compromise. No public proof-of-concept exists, the flaw is not in CISA's KEV catalog, and no exploitation has been observed in the wild.

Do: Update Google Chrome on macOS to version 153.0.8010.47 or later immediately (check chrome://settings/help), and confirm automatic updates are enabled for all users. Enterprise admins should verify fleet-wide patch levels via policy and expedite the rollout to managed Macs. Because exploitation requires an initial renderer compromise via a malicious page, also reinforce defenses such as site filtering and Safe Browsing enforcement, but treat patching as the primary mitigation.

CVE-2026-91716 is a use-after-free vulnerability (CWE-416) in the Auth component of Google Chrome that was fixed in version 153.0.8010.47. A remote attacker can exploit it by tricking a victim into visiting a crafted HTML page, which triggers the memory-corruption flaw during authentication handling. Successful exploitation allows the attacker to execute arbitrary code outside the browser's sandbox, meaning full compromise of the underlying user account rather than confinement to the sandboxed renderer. All users running Chrome versions prior to 153.0.8010.47 on any supported desktop platform are affected. Google rates the severity High; there is no known public proof-of-concept, it is not in the CISA Known Exploited Vulnerabilities catalog, and no exploitation in the wild has been reported at this time.

Do: Update Google Chrome to version 153.0.8010.47 or later immediately; users can confirm their version via chrome://settings/help. Enterprise administrators should verify that Chrome's auto-update mechanism is enabled and functioning across managed fleets, and push the update to any devices lagging behind. Because the flaw lies in Chromium's Auth component, users of other Chromium-based browsers should also apply their vendors' updates as they become available, since this Chrome CVE version number does not map directly to those products.

Google Chrome on Android prior to version 153.0.8010.47 contains a missing authorization flaw (CWE-862) that allows a malicious app co-installed on the same device to obtain sensitive Chrome information. The attack is local, requires no privileges or user interaction, and has high confidentiality impact only, though the CVSS 3.1 score of 5.1 (AV:L/AC:H) indicates exploitation is non-trivial; Chromium rated the issue High severity. All Chrome on Android installations running versions older than 153.0.8010.47 are affected, with the fix shipping in the Chrome 153 stable release that resolved 42 security flaws. No public proof of concept is known, the CVE is not on the CISA Known Exploited Vulnerabilities list, and no in-the-wild exploitation has been reported.

Do: Update Chrome on Android to 153.0.8010.47 or later; Play Store auto-update typically delivers this within days, so verify under Manage apps & device on any device handling sensitive data. For managed Android fleets, enforce a minimum Chrome version of 153.0.8010.47 through device policy. Since exploitation requires a co-installed malicious app, also restrict sideloading and untrusted app sources as a defense-in-depth measure.

CVE-2026-91718 is a use-after-free vulnerability in the Core component of Google Chrome that allows a remote attacker to execute arbitrary code outside the browser sandbox via a specially crafted HTML page. The flaw exists in Chrome versions prior to 153.0.8010.47 and is rated High severity by the Chromium security team. An attacker who successfully exploits this vulnerability gains the ability to run arbitrary code on the victim's system, potentially bypassing Chrome's sandbox protections. All users of Google Chrome who have not yet updated to version 153.0.8010.47 or later are affected. No public proof-of-concept or known in-the-wild exploitation has been reported at this time.

Do: Update Google Chrome to version 153.0.8010.47 or later immediately via Chrome Settings > About Chrome. Enterprise administrators should verify that managed deployments are pulling the latest stable channel update and consider using Chrome's auto-update policies to enforce rapid patching. Monitor for any future reports of in-the-wild exploitation, as use-after-free flaws in Chrome are frequently weaponized once details become public.

CVE-2026-91720 is an uninitialized resource flaw (CWE-908) in ANGLE, the graphics translation layer Google Chrome uses to render WebGL and GPU-accelerated content. A remote attacker triggers the bug by luring a victim to a crafted HTML page, which causes ANGLE to handle uninitialized data in a way that allows the attacker to read memory outside the browser's sandbox. Successful exploitation yields an information disclosure across the sandbox boundary; Chromium rates the issue High severity because it undermines the sandbox that confines renderer compromises, even though the CVSS 3.1 base score is 4.7 (medium) given the required user interaction. All Google Chrome versions prior to 153.0.8010.47 are affected, with the fix shipping in the Chrome 153 stable update that resolved 42 security flaws. No public proof of concept exists, the CVE is not on CISA's Known Exploited Vulnerabilities list, and no exploitation in the wild has been reported.

Do: Update Google Chrome to version 153.0.8010.47 or later immediately, verifying via Help > About Chrome or chrome://settings/help. Enterprises should confirm their managed fleets have the patched version pushed and that auto-update policies are enforced. Because ANGLE is shared Chromium code, users of Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and Electron apps should also apply their vendors' latest builds once available.

CVE-2026-91721 is a critical use-after-free flaw (CWE-416) in Chrome's Internals component affecting versions prior to 153.0.8010.47. A remote attacker triggers it by convincing a user to visit a crafted HTML page, which corrupts freed memory and can lead to arbitrary code execution outside the browser sandbox — a full compromise of the victim's machine rather than a sandboxed renderer compromise. The issue carries a CVSS 3.1 score of 8.8 (network vector, low complexity, no privileges, but user interaction required) and was rated Critical by the Chromium security team. All users of Google Chrome on any platform who have not updated to 153.0.8010.47 or later are affected, with downstream Chromium-based browsers potentially inheriting the flaw. No public proof of concept is known and the vulnerability is not listed in CISA's KEV catalog, so no in-the-wild exploitation has been confirmed at this time.

Do: Update Google Chrome to version 153.0.8010.47 or later immediately (Help > About Google Chrome, or via enterprise policy), and verify the version across managed fleets. Organizations running Chromium-derived browsers (Edge, Brave, Opera, Vivaldi, etc.) should apply those vendors' equivalent updates once released, since they inherit the vulnerable Blink/V8 codebase. Because exploitation requires only a user clicking a crafted link, consider reinforcing phishing defenses and enabling Chrome's automatic update policies for managed devices.

CVE-2026-91724 is a high-severity use-after-free vulnerability in the Input component of Google Chrome, affecting all versions prior to 153.0.8010.47. It is triggered when a victim loads a crafted HTML page, but exploitation requires the attacker to have already compromised the browser's renderer process, typically by chaining this flaw with a separate renderer bug. Successful exploitation allows the attacker to escape Chrome's sandbox and execute arbitrary code with the privileges of the browser process on the victim's machine. All users running unpatched Chrome builds are affected, as are users of other Chromium-based browsers once vendors fold in the fix. There is no known public proof of concept, and the vulnerability is not listed in CISA's KEV catalog, indicating no confirmed in-the-wild exploitation at this time.

Do: Update Google Chrome to version 153.0.8010.47 or later immediately, and confirm auto-update has propagated across managed fleets (check chrome://version or enterprise policy status). Because this is a sandbox-escape primitive that chains with renderer compromise, defenders should pair the update with monitoring for unusual child-process behavior from the browser. Users of Chromium-derived browsers such as Edge, Brave, Opera, and Vivaldi should also apply those vendors' updates as they land the same fix.

CVE-2026-91726 is an out-of-bounds read (CWE-125) in the WebGL implementation of Google Chrome on Android, fixed in version 153.0.8010.47. A remote attacker triggers the flaw by convincing a user to visit a crafted HTML page, which causes the browser to read memory outside of Chrome's sandbox. Although the CVSS 3.1 base score is 4.7 (medium) due to the requirement for user interaction and limited confidentiality-only impact, Google's Chromium team rates it Critical because defeating the sandbox boundary undermines Chrome's core security model. Only Chrome on Android versions prior to 153.0.8010.47 are affected; desktop and other-platform Chrome builds are not in scope per the advisory. There is no known public proof of concept, the CVE is not on CISA's KEV list, and no exploitation in the wild has been reported; the flaw was patched as one of three critical issues in the Chrome 153 update.

Do: Update Chrome on Android to 153.0.8010.47 or later immediately (Settings > About Chrome, or via Google Play) — the fix is included in the Chrome 153 release. For managed Android fleets, verify the deployed Chrome version and push the update rather than waiting for the automatic rollout. Because exploitation only requires a user to visit a malicious page, no special network mitigation exists beyond patching; investigate any reports of sensitive process memory disclosures on unpatched devices.

An incorrect reference resolution flaw (CWE-706) in the Extensions component of Google Chrome on macOS, fixed in version 153.0.8010.47, permits a sandbox escape. Exploitation requires a local attacker who has already compromised Chrome's renderer process — for example by chaining a malicious webpage with a separate renderer bug — and then abuses the flaw via a local program to execute arbitrary code outside the sandbox. Successful exploitation gives code execution with the logged-in user's privileges, with high impact to confidentiality, integrity, and availability (CVSS 3.1: 8.1, High). Per the advisory, only Chrome on macOS is affected, in versions prior to 153.0.8010.47. No public proof-of-concept is known, the CVE is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

Do: Update Chrome on macOS to 153.0.8010.47 or later immediately (Chrome menu > Help > About Google Chrome) and verify that enterprise policy is not blocking auto-updates on managed Mac fleets. Check whether Chromium-based derivatives (Edge, Brave, Opera, and similar) have shipped the corresponding backported fix, since they inherit upstream extension code. Because exploitation requires a chained renderer compromise plus local access, prioritize high-value or frequently-targeted users and ensure monitoring for renderer-process crashes and suspicious child-process behavior is in place.

CVE-2026-91728 is an integer overflow (CWE-190) in the V8 JavaScript engine used by Google Chrome, fixed in version 153.0.8010.47. The flaw is triggered when a user visits a crafted HTML page, where malformed JavaScript causes an integer overflow leading to memory corruption in the renderer. Successful exploitation allows a remote attacker to execute arbitrary code inside the browser sandbox, and Chromium rates the severity High; the CVSS 3.1 score of 9.6 reflects high impact to confidentiality, integrity, and availability if chained with a separate sandbox escape. All users running Chrome versions prior to 153.0.8010.47 on any platform are affected. No public proof-of-concept is known, the flaw is not on CISA's KEV list, and no exploitation in the wild has been reported.

Do: Update Google Chrome to version 153.0.8010.47 or later immediately and verify via Help > About Chrome; enterprises should confirm auto-update policies are not delaying rollout. Because the flaw resides in V8, users of other Chromium-based browsers (Edge, Brave, Opera, Vivaldi) should apply those vendors' updates as the fix propagates. Exploitation requires user interaction with a malicious page, so blocking known-bad links adds defense-in-depth, but patching is the definitive mitigation.

CVE-2026-91729 is a use-after-free memory corruption flaw (CWE-416) in the DigitalCredentials component of Google Chrome, fixed in version 153.0.8010.47. A remote attacker triggers it by using social engineering to lure a victim to a crafted HTML page that causes the browser to access freed memory in that component. Successful exploitation allows the attacker to execute arbitrary code outside Chrome's sandbox, a capability Chromium's security team rates as High severity. All users running Chrome versions earlier than 153.0.8010.47 are affected. No public proof-of-concept is known, the flaw is not on CISA's Known Exploited Vulnerabilities catalog, and there is no evidence of exploitation in the wild.

Do: Update Google Chrome to version 153.0.8010.47 or later immediately; the fix ships in the Chrome 153 stable release, which resolved 42 security flaws. Enterprise and IT admins should verify that auto-update has applied the new version across managed fleets (check Help > About or chrome://version on endpoints). Chromium-derived browsers such as Edge, Brave, and Opera generally inherit this component, so apply their corresponding security updates as vendors release them.

CVE-2026-91731 is a high-severity type confusion flaw (CWE-843) in the Compositing component of Google Chrome in versions prior to 153.0.8010.47. It is triggered remotely when a victim visits a crafted HTML page, requiring no privileges or attacker access to the target, only user interaction such as clicking a malicious link. Successful exploitation lets the attacker execute arbitrary code inside the browser's renderer sandbox, so an attacker controls the compromised tab process but would need a separate sandbox escape to reach the host system. All users running Chrome older than 153.0.8010.47 on any platform are affected, and Chromium-derived browsers typically inherit the vulnerable code until they ship the corresponding fix. No public proof-of-concept is known, the CVE is not on CISA's KEV list, and no exploitation in the wild has been reported.

Do: Update Google Chrome to version 153.0.8010.47 or later immediately (Settings → About Chrome forces the update check). Enterprise administrators should confirm auto-update policies are not withholding the fixed build and push it fleet-wide, and users of Chromium-based browsers such as Edge, Brave, Opera, and Vivaldi should apply those vendors' updates once they incorporate the fix. Because exploitation is confined to the renderer sandbox, keep site isolation and the operating-system sandbox enabled to limit damage if the bug is chained with a sandbox escape.

Google Chrome versions prior to 153.0.8010.47 contain an improper state validation flaw (CWE-754) in Skia, the browser's core 2D graphics rendering library. A remote attacker who has already compromised the renderer process — for example by chaining a separate renderer memory-corruption bug — can trigger the flaw through a crafted HTML page and read memory outside the Chrome sandbox. This provides a sandbox-escape primitive that, when combined with an initial renderer exploit, breaks Chrome's core security boundary and can expose sensitive process memory. All users running Chrome older than 153.0.8010.47 are affected. Google rates the severity High, and there is currently no known public proof of concept and no indication of in-the-wild exploitation.

Do: Update Google Chrome to version 153.0.8010.47 or later immediately — desktop Chrome normally self-updates, so verify the running version at chrome://settings/help. Enterprise admins should confirm the patched build has rolled out fleet-wide and check that update-deferral or pinning policies are not holding devices on older versions. Because this bug is a sandbox-escape stage typically chained with a separate renderer exploit, also update Chromium-based browsers (Edge, Brave, Opera, etc.) as vendors ship downstream patches.

Google Chrome on Windows contains an incorrect authorization flaw (CWE-863) in its Core component that lets a local attacker execute arbitrary code outside the browser's sandbox by abusing a local program. The vulnerability is triggered when an attacker already running code or a malicious program on the victim's machine exploits the authorization gap to break out of Chrome's sandbox, which is designed to contain compromised renderer processes. A successful escape grants the attacker execution with the privileges of the logged-in user outside the sandbox, enabling full compromise of confidentiality, integrity, and availability of the user's session. All Chrome versions on Windows prior to 153.0.8010.47 are affected, while other platforms (macOS, Linux, ChromeOS, Android) are not named as affected. Google rates this High severity (CVSS 7.4), and no public proof of concept or in-the-wild exploitation is currently known.

Do: Update Chrome on Windows to version 153.0.8010.47 or later immediately; verify via Help > About Chrome, since auto-update may lag on managed or offline machines. Enterprises should confirm fleet-wide patch status through browser management tools and treat any host with an unpatched Chrome plus local malware infections as potentially sandbox-escaped. Restrict untrusted local software execution and application whitelisting also reduce the practical attack path, since exploitation requires a local program.

Google Chrome prior to 153.0.8010.47 contains an incorrect authorization flaw (CWE-863) in its WebUI, the privileged chrome:// internal-page component. A remote attacker who has already compromised the renderer process — typically by first exploiting a separate renderer bug delivered via a crafted HTML page the victim visits — can abuse this flaw to execute arbitrary code outside the browser sandbox. Successful escape grants code execution with the browser process's full privileges on the host system, effectively defeating Chrome's core sandboxing defense. All users running Chrome versions older than 153.0.8010.47 are affected. No public proof of concept exists and the issue is not on CISA's Known Exploited Vulnerabilities list, but Google rates it High severity (CVSS 3.1: 8.3).

Do: Update Chrome to 153.0.8010.47 or later immediately; Chrome auto-updates by default, but users should verify at chrome://settings/help and restart the browser. Enterprise administrators should enforce the patched version floor via group policy or device management update controls. Because exploitation requires chaining a renderer compromise with this sandbox escape, prompt patching closes the escape route even if a separate renderer bug is being leveraged.

CVE-2026-91736 is a use-after-free flaw (CWE-416) in the Document Object Model (DOM) implementation of Google Chrome, fixed in version 153.0.8010.47. A remote attacker can trigger the flaw by convincing a victim to load a crafted HTML page, which causes the renderer to access freed memory, resulting in heap corruption and execution of arbitrary code inside the Chrome sandbox. Successful exploitation gives the attacker code execution in the context of the compromised renderer process with high impact to confidentiality, integrity, and availability (CVSS 3.1: 8.8), though the code runs inside the sandbox rather than at full OS privileges unless chained with a separate sandbox escape. All users running Chrome versions prior to 153.0.8010.47 are affected. No public proof of concept exists, the issue is not listed in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported.

Do: Update Google Chrome to version 153.0.8010.47 or later immediately; because updates apply only on relaunch, users should check chrome://settings/help and fully restart the browser. Enterprise administrators should verify fleet-wide patch status via their browser management console (e.g., Google Admin console or WSUS-managed Chrome updates) and force relaunch policies to eliminate lingering unpatched sessions. Since exploitation requires only that a user visit a malicious page, sites that serve suspicious or user-submitted HTML content deserve heightened scrutiny until patch coverage is confirmed.

CVE-2026-91737 is a use-after-free vulnerability (CWE-416) in the PDF handling functionality of Google Chrome, fixed in version 153.0.8010.47. A remote attacker can trigger the flaw by convincing a user to visit a crafted HTML page, which corrupts memory during PDF processing and allows arbitrary code execution inside the browser's sandbox. Chromium rates the severity High, meaning it is a strong candidate for use in exploit chains, particularly when combined with a separate sandbox-escape bug. All users running Chrome versions older than 153.0.8010.47 on any platform are affected, since PDF rendering is a core browser feature. No public proof of concept exists, the flaw is not on the CISA Known Exploited Vulnerabilities list, and no in-the-wild exploitation has been reported.

Do: Update Google Chrome to version 153.0.8010.47 or later immediately; users can verify their version at chrome://settings/help, where updates apply automatically on restart. Enterprise administrators should confirm managed devices are on 153.0.8010.47 or later and expedite rollout, since the fix shipped as part of the Chrome 153 stable channel update. Because this bug only yields code execution inside the sandbox, defenders should also ensure sandboxing remains enabled and keep an eye out for follow-on sandbox-escape bugs that could turn this into a full compromise.

CVE-2026-91740 is an uninitialized resource flaw (CWE-908) in the Skia graphics library used by Google Chrome, fixed in the Chrome 153 stable update (version 153.0.8010.47) that resolved 42 security flaws. A remote attacker triggers the bug by luring a victim to open a crafted HTML page, which causes Skia to expose uninitialized data during page rendering. Successful exploitation lets the attacker read cross-origin data from the victim's browser session, violating the browser's same-origin protections and potentially exposing content from other websites the victim has visited. All users running Chrome versions prior to 153.0.8010.47 are affected, though Chrome's auto-update mechanism typically narrows the unpatched window. Chromium rates the issue High severity (CVSS 3.1: 4.3, medium, user interaction required); it is not in the CISA KEV catalog, and no public proof of concept or in-the-wild exploitation is known.

Do: Update Google Chrome to version 153.0.8010.47 or later on all desktops and verify at chrome://settings/help. Enterprise and education admins should confirm their update policies have pushed the fixed build and expedite any devices lagging behind. Users of other Chromium-based browsers that bundle Skia (e.g., Edge, Brave, Opera) should also apply the latest updates from those vendors, since the underlying engine flaw is inherited.

CVE-2026-91741 is a type confusion vulnerability (CWE-843) in the CacheStorage component of Google Chrome, fixed in version 153.0.8010.47. A remote attacker can trigger the flaw by convincing a user to visit a crafted HTML page, which causes the browser to misinterpret an object's type and leads to memory corruption. Successful exploitation allows the attacker to execute arbitrary code inside Chrome's renderer sandbox, with the CVSS 3.1 base score of 8.8 reflecting full impact to confidentiality, integrity, and availability within the browser context. All users running Chrome versions older than 153.0.8010.47 are affected, which encompasses a substantial share of the browser's user base until updates propagate. As of now, the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, no public proof of concept is known, and no in-the-wild exploitation has been reported.

Do: Update Google Chrome to version 153.0.8010.47 or later immediately; desktop Chrome normally auto-updates, but users should verify via 'Help > About Google Chrome' or chrome://settings/help. Enterprise administrators should push the patched version via update policy (e.g., the RelaunchNotification and RolloutStrategy Chrome enterprise policies) and confirm fleet-wide compliance. Defenders should also monitor for users of Chromium-based derivatives (Edge, Brave, Opera, Vivaldi) and apply their corresponding patched builds, since they inherit the underlying CacheStorage code.

CVE-2026-91743 is a race condition (CWE-367) in the Core component of Google Chrome in versions prior to 153.0.8010.47. The vulnerability is triggered when a victim visits a crafted HTML page, allowing a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the Chrome sandbox. In practice, this flaw serves as the second stage of a full browser compromise: an attacker would first need a separate renderer bug to gain code execution inside the sandbox, then use this race condition to escape it and run code with the user's full privileges. All users running Chrome older than 153.0.8010.47 on any platform are affected. Google rated the issue High severity (CVSS 8.3); there is no known public proof of concept, it is not on the CISA KEV list, and no in-the-wild exploitation has been reported.

Do: Update Google Chrome to version 153.0.8010.47 or later immediately; desktop builds normally auto-update but a manual check via Help > About Google Chrome confirms the patch is applied. Enterprise and education administrators should verify their update policies (Chrome Browser Cloud Management or Group Policy) have pushed the fixed build to all managed endpoints, including VDI and shared workstation images. Because exploitation requires a prior renderer compromise, keeping Chrome fully patched on the latest stable channel significantly reduces the viability of any full exploit chain.

A race condition (CWE-367) in the PlatformIntegration component of Google Chrome on macOS, versions prior to 153.0.8010.47, allows a remote attacker to obtain sensitive information. The flaw is triggered when a victim interacts with a crafted HTML page, but exploitation requires the attacker to have already compromised the browser's renderer process and to leverage social engineering, consistent with the High attack-complexity and user-interaction requirements in the CVSS vector. A successful attack compromises confidentiality but does not affect integrity or availability. Only Chrome builds on Mac earlier than 153.0.8010.47 are listed as affected. No public proof-of-concept is known and the issue is not on CISA's Known Exploited Vulnerabilities catalog, so no in-the-wild exploitation has been reported.

Do: Update Chrome on macOS to version 153.0.8010.47 or later via Help > About Chrome (chrome://settings/help), which forces the update check. Enterprise administrators should verify that managed Mac fleets have pulled the patched version, since policy-controlled rollout can lag consumer auto-updates. Because exploitation requires a prior renderer compromise plus user interaction, confirming Site Isolation is enabled provides additional defense-in-depth.

CVE-2026-91746 is an integer overflow (CWE-190) in the Compositing component of Google Chrome, fixed in version 153.0.8010.47 as part of an update addressing 42 security flaws. It is triggered when a victim views a crafted HTML page, causing the compositing code to overflow an integer and enabling a remote attacker to obtain cross-origin data, violating the browser's same-origin policy. The practical impact is limited to information disclosure (confidentiality only, no code execution or integrity impact per the CVSS 3.1 vector, which requires user interaction and rates the issue 4.3 medium). All users running Chrome versions prior to 153.0.8010.47 are affected, which is effectively the majority of the installed base at the time of disclosure. There is no known public proof-of-concept, the flaw is not on the CISA Known Exploited Vulnerabilities list, and no in-the-wild exploitation has been reported.

Do: Update Chrome to version 153.0.8010.47 or later immediately (Settings > About Chrome triggers the update check), and confirm the version after updating. Enterprise administrators should verify auto-update policies (e.g., the UpdateDefault policy) are set to force updates and monitor fleet compliance. Because exploitation requires the user to open a crafted page, user awareness of unsolicited links provides defense-in-depth, but patching is the primary mitigation.

CVE-2026-91747 is a use-after-free vulnerability in Skia, the graphics rendering library used by Google Chrome, fixed in version 153.0.8010.47. It is a second-stage flaw: a remote attacker must first have compromised the renderer process (typically via a separate bug), then trigger the use-after-free through a crafted HTML page to break out of renderer sandbox restrictions and read cross-origin data, bypassing the same-origin policy. Google rates the Chromium severity as High because such renderer-to-browser primitives are valuable components of full exploit chains, though the CVSS base score is low (3.1) since exploitation requires prior renderer compromise and user interaction. All users of Chrome versions prior to 153.0.8010.47 are affected, and other Chromium-based browsers that bundle Skia likely inherit the flaw until their vendors ship the fix. There is no known public proof of concept and no evidence of in-the-wild exploitation; the issue is not on the CISA Known Exploited Vulnerabilities list.

Do: Update Chrome to 153.0.8010.47 or later immediately (Help > About Chrome / chrome://settings/help); enterprises should push the update via Group Policy or their management console and verify fleet-wide versions. Users of Chromium derivatives such as Edge, Brave, Opera, and Vivaldi should apply their vendors' updates as soon as available, since they bundle the same Skia code. Because this bug requires the renderer to already be compromised, keeping the browser fully patched also closes the first-stage bugs an attacker would need to chain with it.

CVE-2026-91749 is a critical-severity use-after-free vulnerability (CWE-416) in the Workers component of Google Chrome, fixed in version 153.0.8010.47. A remote attacker triggers the flaw by luring a victim to a crafted HTML page, where a freed memory object in the Worker implementation is improperly reused, potentially allowing arbitrary code execution outside the browser sandbox. Successful exploitation means a malicious webpage can escape Chrome's sandbox and run code on the underlying operating system with the user's privileges, effectively fully compromising the workstation. All Chrome installations prior to 153.0.8010.47 are affected on every platform, and third-party Chromium-based browsers inherit the vulnerable engine code until they ship the upstream fix. No public proof-of-concept is known and the bug is not on CISA's Known Exploited Vulnerabilities catalog, but the Critical severity rating indicates Google judged the potential impact to be severe.

Do: Update Google Chrome to version 153.0.8010.47 or later immediately and verify via chrome://settings/help; enterprises should confirm update policies have applied the fix fleet-wide. Because exploitation requires only that a victim visit a crafted page, defenders should monitor EDR telemetry for renderer/worker-process crashes or unexpected child processes spawned by Chrome until the fleet is fully patched. Administrators of Chromium-based browsers that bundle the same engine (e.g., Edge, Brave, Vivaldi, Opera) should deploy those vendors' equivalent updates as soon as they are released.