Google Chrome 153 Update Fixes 16 Security Flaws, Including Two Critical Vulnerabilities

CVE-2026-93372 is a buffer overflow (CWE-121) in the WebGL component of Google Chrome on Android, fixed in Chrome 153.0.8010.52. A remote attacker can trigger it by luring a user to a crafted HTML page that renders malicious WebGL content, causing memory corruption in the browser process. Successful exploitation allows arbitrary code execution outside the sandbox, which defeats Chrome's key containment boundary and grants the attacker significantly broader access on the device. All Chrome for Android users running versions prior to 153.0.8010.52 are affected; the flaw carries a Critical Chromium security severity rating. There is currently no evidence of exploitation in the wild, no public proof-of-concept, and the issue is not on CISA's KEV list; it was patched as one of 16 flaws in the Chrome 153 release.

Do: Update Chrome on Android to version 153.0.8010.52 or later via the Google Play Store and verify the version at chrome://version. Until patched, avoid following links from untrusted sources, since a crafted web page alone can trigger the flaw. Organizations should use MDM/enterprise policies to force the Chrome update fleet-wide, and desktop users should also apply the latest Chrome 153 release, which fixes 16 issues including two critical ones.

CVE-2026-93373 is a use-after-free memory corruption bug (CWE-416) in the Extensions component of Google Chrome. An attacker can trigger it by getting a user to load a crafted Chrome extension, which frees memory that is subsequently reused. Successful exploitation allows a remote attacker to execute arbitrary code outside the browser's sandbox, meaning the code escapes Chrome's strongest isolation layer and runs with broader system privileges. All Chrome users running versions prior to 153.0.8010.52 are affected, and Google has patched the flaw in that release as part of an update fixing 16 security issues, including two critical vulnerabilities. There is currently no evidence of exploitation in the wild, no CISA KEV listing, and no known public proof-of-concept.

Do: Update Google Chrome to 153.0.8010.52 or later on all platforms (check via chrome://settings/help) and restart the browser to complete the fix. Enterprises should enforce minimum-version compliance via endpoint management, audit installed extensions and remove unvetted ones, and treat extension installation as the primary attack vector until systems are patched.

CVE-2026-93374 is a use-after-free memory-corruption flaw in Dawn, the WebGPU component of Google Chrome, affecting Chrome on Android prior to version 153.0.8010.52. An attacker can trigger it remotely by convincing a user to open a specially crafted HTML page. Successful exploitation could allow arbitrary code execution outside the browser's security sandbox, which is a severe outcome because it escapes Chrome's core containment mechanism. All users of Chrome for Android on unpatched versions are affected; Google rates the flaw Critical and shipped the fix in Chrome 153, which patched 16 vulnerabilities including two critical ones. No public proof-of-concept or confirmed in-the-wild exploitation is currently known, and the issue is not yet on CISA's KEV list.

Do: Update Chrome for Android to 153.0.8010.52 or later via the Google Play Store (check the actual version at chrome://version, as Play Store rollout can lag). Enable automatic Chrome updates and avoid untrusted web pages until updated; desktop Chrome users should also apply the Chrome 153 update, which addresses 16 flaws in the same release.

CVE-2026-93375 is an incorrect reference resolution flaw (CWE-706) in the Tracing component of Google Chrome on Windows. A local attacker who can already run a program on the machine can abuse the flaw to potentially execute arbitrary code outside the Chrome sandbox, meaning code escapes the browser's process-isolation boundary. Successful exploitation typically serves as a sandbox escape that can be chained with other browser flaws for fuller system compromise. Only Chrome on Windows prior to 153.0.8010.52 is affected; the fix shipped in the Chrome 153.0.8010.52 release, which addressed 16 security issues including two critical ones. No public proof-of-concept is known, the issue is not on the CISA KEV list, and no in-the-wild exploitation has been confirmed.

Do: Update Google Chrome on Windows to version 153.0.8010.52 or later immediately (via Settings > About Chrome or your enterprise update channel) and verify the version at chrome://version. Because exploitation requires a local program, prioritize patching shared, multi-user, and kiosk-style Windows systems where local code execution by untrusted users is more likely. No mitigation short of upgrading is published; restrict local program execution on sensitive machines in the interim.

CVE-2026-93376 is an out-of-bounds read (CWE-125) in the DataTransfer component of Google Chrome, fixed in version 153.0.8010.52. A local attacker must use social engineering to convince a user to run a local program, which then interacts with Chrome in a way that reads memory outside the browser sandbox. Successful exploitation yields disclosure of memory contents from outside the sandbox, an information-exposure issue rather than code execution, and Chromium rates it Medium severity. All users running Chrome versions prior to 153.0.8010.52 are affected, and the fix shipped as part of the Chrome 153 release that addressed 16 security flaws, including two critical ones. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation has been reported.

Do: Update Google Chrome to 153.0.8010.52 or later and confirm the version via the browser's About/Help page, refreshing the update if needed. Because exploitation requires a local program and social engineering, exercise caution when running untrusted local executables. No interim mitigations are required beyond patching.

CVE-2026-93377 is a type confusion flaw (CWE-843) in V8, the JavaScript engine used by Google Chrome. An attacker triggers it by convincing a user to open a specially crafted HTML page, meaning successful attacks require a social-engineering step such as a phishing link. If exploited, the attacker can execute arbitrary code within the Chrome renderer sandbox, limiting but not eliminating the impact of the compromise. All Chrome users running versions prior to 153.0.8010.52 are affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time; the fix shipped in Chrome 153, which addressed 16 security issues in total.

Do: Update Google Chrome to 153.0.8010.52 or later on all platforms (check via chrome://settings/help), and force the update across managed fleets using enterprise update policies. Because exploitation requires luring users to a crafted page, reinforce phishing awareness and verify the browser version on high-risk endpoints.

CVE-2026-93378 is a missing-authorization (CWE-862) flaw in the Storage component of Google Chrome, where storage operations fail to properly enforce origin checks. To trigger it, an attacker who has already compromised a renderer process (for example via a chained memory-corruption bug) induces the victim to open a crafted PDF file. Successful exploitation lets the attacker bypass Chrome's site isolation, meaning code in a compromised renderer could potentially access cross-origin data belonging to other sites — a defense-in-depth defeat typically used to escalate a renderer compromise into cross-site data theft. Anyone running Google Chrome before 153.0.8010.52 is affected; the issue is rated Medium by Chromium and was fixed in the Chrome 153.0.8010.52 release, which addressed 16 total flaws including two critical ones. There is no known exploitation, no public proof-of-concept, and the flaw is not listed in CISA KEV.

Do: Update Google Chrome to 153.0.8010.52 or later immediately (Menu > Help > About Chrome forces the auto-update) and confirm the version at chrome://version. Because exploitation requires an already-compromised renderer, treat this as a chaining target and ensure all renderer/memory-safety fixes from this release are applied as well. No workaround is practical since PDF viewing is built in; rely on prompt patching.

CVE-2026-93379 is an incorrect authorization flaw (CWE-863) in the ORB (Opaque Response Blocking) component of Google Chrome that allows a remote attacker to bypass the browser's site isolation protections. The flaw is triggered when a victim loads a specially crafted HTML page, for example via a malicious or compromised website. A successful attacker could circumvent site isolation, the boundary that is supposed to keep content from one site separate from another, potentially enabling access to cross-origin data that should be isolated. Anyone running Google Chrome prior to version 153.0.8010.52 is affected, which effectively spans the browser's entire multi-billion-user installed base until they update. There are currently no known public proofs of concept, no reports of exploitation in the wild, and the issue is not listed in CISA's KEV catalog; it was patched in Chrome 153, which fixes 16 security issues including two critical ones.

Do: Update Google Chrome to 153.0.8010.52 or later (verify via chrome://settings/help and restart the browser to fully apply the patch). Since no PoC or in-the-wild exploitation is known, prompt patching is the primary action; enterprises should push the updated version through their browser update management and confirm fleet versions. Users who cannot update immediately should exercise caution with untrusted links, as exploitation requires loading a crafted HTML page.

Google Chrome's FileSystem implementation contains a time-of-check to time-of-use (TOCTOU) race condition (CWE-367) that allows system access restrictions to be bypassed. Triggering it requires a crafted HTML page, an attacker who has already compromised the renderer process via a separate flaw, and social engineering to persuade the user, per Google's advisory. Successful exploitation lets the attacker bypass system access restrictions; Chromium rates the issue Medium severity. All Chrome users running versions earlier than 153.0.8010.52 are affected until they update. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; the fix shipped in Chrome 153, which addresses 16 vulnerabilities including two critical ones.

Do: Update Google Chrome to 153.0.8010.52 or later via chrome://settings/help and restart the browser; verify auto-update is enabled across your fleet. Because this flaw is designed to be chained from a compromised renderer plus user interaction, prioritize applying the full Chrome 153 release (16 fixes, including two critical ones). Check endpoint management or browser update reporting tools to confirm no clients remain on pre-153 builds.

CVE-2026-93381 is a buffer overflow (CWE-122) in the PDFium PDF rendering engine of Google Chrome on Windows. To trigger it, an attacker must use social engineering to convince a user to open a specially crafted PDF file, which causes the overflow in Chrome's PDF renderer. Successful exploitation could allow a remote attacker to execute arbitrary code, though only inside Chrome's sandbox, which constrains the impact of the compromise. All Chrome users on Windows running versions prior to 153.0.8010.52 are affected; users on other operating systems are not impacted by this specific flaw. There is currently no CVSS score, no entry in the CISA KEV catalog, no known public proof-of-concept, and no confirmed exploitation in the wild, and the fix shipped in Chrome 153.0.8010.52 alongside roughly 15 other security fixes, including two rated critical.

Do: Update Google Chrome on Windows to 153.0.8010.52 or later (Help > About Google Chrome, or enforce via endpoint management) and verify deployed versions with your fleet inventory tools. Until patched, caution users against opening PDFs from untrusted or unexpected sources, since exploitation depends on social engineering. Prioritize the update, as the same Chrome 153 release also addresses two critical vulnerabilities.

CVE-2026-93382 is a use-after-free (CWE-416) memory-safety flaw in PDFium, the PDF rendering engine embedded in Google Chrome. A remote attacker can trigger it by luring a user to a specially crafted HTML page, causing Chrome's PDF component to access freed memory. Successful exploitation lets the attacker execute arbitrary code inside the Chrome sandbox, which constrains the damage but still constitutes a serious compromise of the renderer process. All Chrome users running a version prior to 153.0.8010.52 are affected; the fix shipped in the Chrome 153 release, which addressed 16 security issues including two critical ones. There is currently no evidence of exploitation in the wild, no CISA KEV listing, and no known public proof-of-concept.

Do: Update Google Chrome to 153.0.8010.52 or later immediately (check via chrome://settings/help or relaunch the browser to trigger auto-update), and verify the version on shared or managed machines. Enterprise administrators should push the update via their endpoint management tools and consider policies that force browser restarts after update. As an interim mitigation, avoid opening untrusted PDF content and exercise caution with unfamiliar web pages until browsers are patched.

CVE-2026-93383 is an information disclosure flaw (CWE-200) in the Permissions component of Google Chrome, fixed in version 153.0.8010.52. A remote attacker can trigger the flaw by luring a user to a specially crafted HTML page, which causes the browser to leak data from cross-origin sites in violation of the same-origin policy. An attacker gains access to content or data from other origins that the victim's browser has access to, potentially including sensitive page content from other sites. All users of Google Chrome versions prior to 153.0.8010.52 are affected. No public proof-of-concept is known, the issue is not listed in CISA's KEV catalog, and exploitation has not been confirmed in the wild.

Do: Update Google Chrome to version 153.0.8010.52 or later (verify via chrome://settings/help or chrome://version) and restart the browser to complete the update; ensure automatic updates are enabled for managed fleets. As interim mitigation, exercise caution with untrusted websites, since exploitation requires rendering a crafted HTML page. Treat this as a medium-severity, low-friction patch and roll it out with the regular Chrome 153 update cycle, which also addresses two critical vulnerabilities.

CVE-2026-93384 is a server-side request forgery (SSRF) flaw in the Omnibox (address bar) component of Google Chrome running on Android. It can be triggered by a remote attacker who uses social engineering to induce user actions, causing the browser to send crafted network traffic that bypasses system access restrictions. A successful exploit lets the attacker reach resources or services that should be blocked by those restrictions, though the Medium Chromium severity and social-engineering requirement limit the practical impact. Only Chrome on Android is named in the advisory; affected versions are those prior to 153.0.8010.52. There are no reports of exploitation in the wild, no public proof of concept, and the flaw is not listed in CISA's KEV; the fix shipped in Chrome 153.0.8010.52, which addresses 16 security flaws in total, including two critical ones.

Do: Update Chrome on Android to version 153.0.8010.52 or later via Google Play (Settings > About Chrome > check for updates) and relaunch the browser. Given the Medium severity and social-engineering prerequisite, this is not an emergency patch, but applying it promptly also picks up the two critical fixes in the same Chrome 153 release. Desktop and other Chrome builds should still be kept current per Google's regular update channel.

An information leak exists in the Paint component of Google Chrome that allows a remote attacker to obtain sensitive information by tricking a user into visiting a crafted HTML page. The flaw is classified as CWE-200 (Exposure of Sensitive Information) and carries a Medium severity rating from the Chromium security team. All users of Google Chrome prior to version 153.0.8010.52 are affected across the platforms on which Chrome ships. Successful exploitation yields access to sensitive information from the browser's rendering/painting process, but the flaw does not permit arbitrary code execution. No public proof-of-concept is known and the issue is not in CISA's KEV catalog; it was patched as one of 16 vulnerabilities in the Chrome 153.0.8010.52 release.

Do: Update Google Chrome to version 153.0.8010.52 or later (check via chrome://settings/help or deploy the updated MSI/enterprise package). Because the flaw is triggered by a crafted HTML page, instruct users to avoid untrusted links until patching is complete. Note that the same release fixes 15 other issues including two critical vulnerabilities, so apply the 153.0.8010.52 update promptly and completely.

CVE-2026-93386 is a UI misrepresentation flaw (CWE-451) in the WebAppInstalls component of Google Chrome, allowing a remote attacker to spoof UI elements through a specially crafted HTML page. The attack is triggered via social engineering: a user must be lured into opening the crafted page, which then presents misleading interface elements, such as a deceptive web-app install prompt or dialog content. Successful spoofing could make fake prompts or dialogs appear trustworthy, tricking users into actions or beliefs that aid a phishing-style deception. All users running Google Chrome versions prior to 153.0.8010.52 are affected, and the flaw was rated Low severity by Chromium maintainers. There is no evidence of exploitation in the wild, no public proof-of-concept, and the issue is not listed in CISA's KEV catalog; it was patched in the Chrome 153.0.8010.52 release, which fixed 16 security issues.

Do: Update Google Chrome to version 153.0.8010.52 or later on all desktop platforms (check chrome://settings/help and restart the browser to confirm the update is applied), since Chrome normally auto-updates but may need a restart. As an interim mitigation, treat unexpected web-app install prompts with suspicion and avoid granting install or permission requests from untrusted pages. Monitor the dashboard for any addition to CISA KEV or emergence of a public proof-of-concept.

CVE-2026-93387 is an improper state validation flaw in Skia, the graphics rendering library used by Google Chrome, affecting Chrome versions prior to 153.0.8010.52. An attacker triggers it by luring a victim to a crafted HTML page, which causes Skia to mishandle rendering state and break the same-origin policy. A successful attack allows a remote attacker to read cross-origin data from other sites the victim has open or authenticated to, potentially exposing sensitive page content, tokens, or account information. All Chrome users on pre-153 builds are affected, and the flaw was rated High severity by the Chromium team; Google shipped the fix in the Chrome 153 release alongside 15 other security fixes. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time.

Do: Update Google Chrome to version 153.0.8010.52 or later immediately via chrome://settings/help, and confirm the patched version is reflected there after relaunch. Enterprise administrators should push the 153.0.8010.52 update through managed update policies (e.g., Google Admin console or MSI deployment) and audit endpoints for outdated builds. Until updated, exercise caution with untrusted links, as the flaw is triggered simply by loading a malicious web page.