Google has launched the Chrome 153 update, addressing a total of 42 security vulnerabilities, some of which are deemed critical. This update is incrementally rolling out on Windows, macOS, and Linux, with version 153.0.8010.47/.48 available for the first two and 153.0.8010.47 for the latter.
Critical Vulnerabilities Identified
The update resolves three major vulnerabilities, each classified as Critical. CVE-2026-91721 is a use-after-free issue within Chrome’s Internals, identified by researcher xinyang. Another, CVE-2026-91749, affects Workers and was reported by WinD39–Huynh Dinh Vu. Additionally, CVE-2026-91726 involves an out-of-bounds read in WebGL, discovered internally by Google.
Use-after-free vulnerabilities occur when software refers to memory after it has been freed, leading to potential security risks such as data exposure or arbitrary code execution. The WebGL flaw is particularly concerning as it involves out-of-bounds memory access, which can lead to unanticipated application behavior.
Additional High-Severity Flaws
Chrome 153 also corrects 27 High-severity vulnerabilities. These include various use-after-free bugs across components like Input, Skia, and V8. Type confusion and race conditions are also addressed in components such as Compositing, CacheStorage, and ServiceWorker. Furthermore, issues like integer overflows and improper state validation are part of the update.
Authorization and validation weaknesses further extend the scope of this update. Corrections include authorization problems within Core and WebUI, along with uninitialized resource bugs in ANGLE and Skia. This comprehensive approach highlights the challenges in securing a modern browser environment.
Steps for Users and Administrators
Users are encouraged to navigate to Chrome’s menu, select Help, and then About Google Chrome to initiate the update process, followed by a browser relaunch. While Chrome updates typically occur in the background, a restart is necessary to apply the changes.
Enterprise administrators should expedite the deployment of this update, ensuring all managed devices reflect the new version. It is crucial to check for any systems restricted by update policies or pending restarts. Google provides centralized management tools for Windows, allowing policy reviews at chrome://policy.
Security teams should verify that all installations and alternate channels are updated and confirm users have relaunched their browsers. Simply enabling automatic updates does not guarantee the latest version is operational across all systems.
Google acknowledges the contributions of AddressSanitizer, MemorySanitizer, and other tools in identifying these security issues. Given the importance of this update, users are advised to ensure their Chrome browser is up-to-date to mitigate potential risks.
