Loading story…
Google released Chrome 153 to the Stable channel, fixing 42 security vulnerabilities, including three Critical memory-safety flaws: use-after-free vulnerabilities in Internals (CVE-2026-91721) and Workers (CVE-2026-91749), plus an out-of-bounds read in WebGL (CVE-2026-91726). The update also addresses 27 High-severity issues affecting components including V8, ServiceWorker, Core, Extensions, Skia, ANGLE, PDF, WebPackaging, and Input. High-severity use-after-free bugs include CVE-2026-87639 in WebPackaging, reported by amyb of OpenAI Codex Security, and CVE-2026-87542 in Input, reported by BigSleep@Grape.
Google has not reported active exploitation of any of the fixed vulnerabilities and withheld technical exploit details. Organizations should deploy Chrome 153.0.8010.47/.48 on Windows and macOS or 153.0.8010.47 on Linux, confirm managed endpoints have completed the update and restarted the browser, and investigate devices delayed by update policies or incomplete rollout.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Chrome 153 addressed CVE-2026-87542, a High-severity use-after-free vulnerability in Chrome's Input component. Google credited BigSleep@Grape with reporting the vulnerability.
Chrome 153 addressed CVE-2026-87639, a High-severity use-after-free vulnerability in the WebPackaging component. Google credited researcher “amyb,” working with OpenAI Codex Security, for reporting the issue.
On September 8, 2026, Google released Chrome 153 to the Stable channel. The update addressed 42 reported vulnerabilities, including three Critical flaws—CVE-2026-91721, CVE-2026-91749, and CVE-2026-91726—and 27 High-severity issues; the advisory did not report active exploitation of the fixed flaws.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourcebugflation.com
Open sourcebugflation.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released Chrome 153 for Windows, macOS, Linux, Android, and iOS, fixing 230 reported security vulnerabilities, including **CVE-2026-87491**, an out-of-bounds write in the V8 JavaScript and WebAssembly engine that is reportedly being exploited in the wild. The release includes five critical and 43 high-severity fixes across WebGL, Cast, ANGLE, PDFium, V8, and WebView; organizations should prioritize updating managed browsers to `153.0.8010.36` or later. Google has formally reduced Chrome's stable release cycle from four weeks to two weeks, aiming to shorten the N-day window between public disclosure of a flaw and deployment of a patch. The company cited a growing volume of reports and automated AI-assisted security work, alongside faster-moving AI-enabled threats, as drivers for the accelerated cadence; the schedule will also speed delivery and iteration of Chrome features, including AI capabilities.
Sep 10, 2026
Google released Chrome 151 to fix **41 newly identified vulnerabilities** affecting the browser on Windows, macOS, and Linux, including **six critical flaws** and **35 high-severity issues**. The patched bugs include five **use-after-free** vulnerabilities in **WebGL, Aura, Skia, and Views**, as well as an **out-of-bounds write** in the **ANGLE** graphics engine. Google said the update is rolling out as versions **`151.0.7922.108/.109`** for Windows and macOS and **`151.0.7922.108`** for Linux. The vulnerabilities could lead to **arbitrary code execution, information disclosure, privilege escalation, security restriction bypass, denial of service, crashes, and data corruption**, with more than two dozen tied to memory-safety weaknesses. Google did not report active exploitation in the wild, but users and organizations were urged to update systems running versions prior to the patched releases as soon as possible.
Aug 7, 2026
Google released Chrome 152 for Windows, macOS, and Linux with fixes for 327 vulnerabilities, including 18 rated critical and 53 rated high severity. Affected desktop versions are `152.0.7977.64/.65` for Windows and macOS and `152.0.7977.64` for Linux. The fixes address arbitrary-code-execution, security-bypass, and information-disclosure risks; Google has restricted access to some bug details while users deploy the update and reports no known active exploitation. The most significant fixes include `CVE-2026-79282`, a use-after-free flaw in ANGLE that a malicious HTML page could exploit to execute code outside Chrome's browser sandbox, and `CVE-2026-78899`, a V8 use-after-free vulnerability rated CVSS 8.8 that could enable code execution within the sandbox. Organizations should urgently update managed Chrome installations and require browser restarts, as both flaws are reachable through malicious websites and could be combined in exploit chains.
Aug 27, 2026