30
42
Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones
Google shipped Chrome 153 fixing 42 vulnerabilities, including three Critical use-after-free and out-of-bounds bugs, with no active exploitation reported.
Google's Chrome 153 Stable channel update (153.0.8010.47/.48 for Windows/macOS, 153.0.8010.47 for Linux) patches 42 vulnerabilities: three Critical, 27 High, ten Medium, and one Low. The Critical flaws are CVE-2026-91721 (use-after-free in Internals), CVE-2026-91749 (use-after-free in Workers), and CVE-2026-91726 (out-of-bounds read in WebGL). Google's bulletin states none of the patched issues are actively exploited, and detailed bug links remain restricted until most users receive the fixes. Bug bounty awards include $1,500 to Hafiizh for CVE-2026-91724 and $1,000 to Jihyeon Jeong of Seoul National University for CVE-2026-91728.
58
Google fixes the seventh actively exploited Chrome zero-day of 2026
Google patched 230 Chrome flaws in version 153.0.8010.36, including actively exploited V8 out-of-bounds write CVE-2026-87491 (CVSS 8.8), the seventh 2026 Chrome zero-day.
Google released Chrome 153.0.8010.36 on Linux and 153.0.8010.36/.37 on Windows and Mac, fixing 230 security vulnerabilities. CVE-2026-87491, an out-of-bounds write in the V8 JavaScript and WebAssembly engine (CVSS 8.8), is being exploited in the wild through specially crafted HTML pages to execute arbitrary code inside Chrome's sandbox. Google says it is the seventh actively exploited Chrome zero-day of 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, and CVE-2026-85046. Researcher Jihyeon Jeong of Seoul National University reported it on 2026-08-06 and received a $2,500 bounty; Google disclosed no technical details or attribution.
85
30
30
Russia-linked APT29 reused iOS and Chrome exploits previously developed by NSO Group and Intellexa
60
30
30
42
60
57
60
55
35
45
60
30
Malicious Twitch Extension Exposes OAuth Tokens of 30,000 Chrome and Firefox Users
Malicious 'Twitch Enhanced Viewer | JeetBot' browser extension stole live OAuth session tokens from roughly 31,000 Chrome and Firefox users.
Socket.dev found the cross-store extension 'Twitch Enhanced Viewer | JeetBot' rerouted Twitch playlist requests through operator-controlled proxies, attaching the victim's account-level OAuth token as a URL parameter where it could be logged in cleartext. About 30,000 Chrome and 552 Firefox installs were exposed, with tokens forwarded for nearly every watched channel to infrastructure tied to a Russian commercial bot service. The stolen bearer token enables chat, whisper, account-setting access and channel-point spending without the password or 2FA.
52
Google Chrome 153 Released With 230 Security Fixes and Zero-Day Exploited in the Wild
Google released Chrome 153 with 230 security fixes, patching CVE-2026-87491, a V8 out-of-bounds write zero-day actively exploited in the wild.
Google shipped Chrome 153 (153.0.8010.36/.37) for Windows, macOS, and Linux with 230 security fixes, including CVE-2026-87491, a medium-severity V8 out-of-bounds write being exploited in the wild. The release also fixes five critical vulnerabilities: four in WebGL (two use-after-frees, an out-of-bounds write, a buffer overflow) and one use-after-free in Cast. High-severity V8 use-after-free and type-confusion defects are among the fixes, and Google has restricted technical details until most users are patched. Administrators should verify deployed versions on managed endpoints, as Chrome-derived browsers may follow different patch schedules.
82
42
30
45
30
42
Russian Hackers Exploit Safari and Chrome Flaws in High
60
30
30
30
45
Google fixes the third actively exploited Chrome 0
60
Google addresses two new Chrome zero
60
30
30
42
30
30
30
30
30