widely-deployed-product-advisoryendpoint-software-vulnerability

Chrome 153 Patches 42 Flaws Including Three Critical Memory-Safety Bugs

Patch & Detection Intelligence · 21 sources · Updated 1mo ago · First seen Sep 16, 2026

Google released Chrome 153 to the Stable channel, fixing 42 security vulnerabilities, including three Critical memory-safety flaws: use-after-free vulnerabilities in Internals (CVE-2026-91721) and Workers (CVE-2026-91749), plus an out-of-bounds read in WebGL (CVE-2026-91726). The update also addresses 27 High-severity issues affecting components including V8, ServiceWorker, Core, Extensions, Skia, ANGLE, PDF, WebPackaging, and Input. High-severity use-after-free bugs include CVE-2026-87639 in WebPackaging, reported by amyb of OpenAI Codex Security, and CVE-2026-87542 in Input, reported by BigSleep@Grape.

Google has not reported active exploitation of any of the fixed vulnerabilities and withheld technical exploit details. Organizations should deploy Chrome 153.0.8010.47/.48 on Windows and macOS or 153.0.8010.47 on Linux, confirm managed endpoints have completed the update and restarted the browser, and investigate devices delayed by update policies or incomplete rollout.

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

9 events · Sep 2026 – Sep 18, 2026

Sep 18, 20261mo ago
Canadian Cyber Centre issues Google advisory AV26-939
On September 18, 2026, the Canadian Cyber Centre issued advisory AV26-939, warning that Google was affected by unspecified vulnerabilities and referring users to Google's Stable Channel Update for Desktop. It recommended that users and administrators review the update information and apply necessary updates when available.
Google security advisory (AV26-939) - Canadian Centre for Cyber Security
Sep 17, 20262mo ago
Google releases Chrome 153.0.8010.52 security update
Google's September 17, 2026 stable-channel update remediated multiple vulnerabilities in Chrome versions earlier than 153.0.8010.52, including critical WebGL buffer-overflow CVE-2026-93372 and critical Dawn use-after-free CVE-2026-93374. The update also fixed high-severity PDFium and Extensions use-after-free flaws; no known public exploits were reported.
Google Chrome < 153.0.8010.52 Multiple Vulnerabilities | Tenable®
Sep 16, 20262mo ago
Canadian Cyber Centre issues Chrome advisory AV26-926
The Canadian Cyber Centre issued advisory AV26-926 stating that Google Chrome versions prior to 153.0.8010.48 are affected by unspecified vulnerabilities. It advised users and administrators to consult Google's Stable Channel Update information and apply available updates.
Google security advisory (AV26-926) - Malware News - Malware Analysis, News and Indicators
Sep 15, 20262mo ago
Chrome 153.0.8010.47 details additional Input and V8 vulnerabilities
Google's September 15, 2026 Chrome stable-channel advisory identified CVE-2026-91724, a high-severity Input use-after-free, and CVE-2026-91728, a high-severity V8 integer overflow. Affected macOS installations should upgrade to Chrome 153.0.8010.47 or later; the Nessus advisory reported no known exploits.
Google Chrome < 153.0.8010.47 Multiple Vulnerabilities | Tenable®
Sep 8, 20262mo ago
Chrome 153 fixes Input use-after-free CVE-2026-87542
Chrome 153 addressed CVE-2026-87542, a High-severity use-after-free vulnerability in Chrome's Input component. Google credited BigSleep@Grape with reporting the vulnerability.
Chrome 153 credits Big Sleep on an Input use-after-free - Bugflation
Sep 8, 20262mo ago
Chrome 153 fixes WebPackaging use-after-free CVE-2026-87639
Chrome 153 addressed CVE-2026-87639, a High-severity use-after-free vulnerability in the WebPackaging component. Google credited researcher “amyb,” working with OpenAI Codex Security, for reporting the issue.
Chrome 153 credits Codex Security on a WebPackaging use-after-free - Bugflation
Sep 8, 20262mo ago
Google releases Chrome 153 Stable security update
On September 8, 2026, Google released Chrome 153 to the Stable channel. The update addressed 42 reported vulnerabilities, including three Critical flaws—CVE-2026-91721, CVE-2026-91749, and CVE-2026-91726—and 27 High-severity issues; the advisory did not report active exploitation of the fixed flaws.
Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones
Reported Sep 1, 20262mo ago
Google advisory recommends Chrome 153.0.8010.53 or later
Google published a September 17, 2026 security advisory for vulnerabilities affecting Chrome versions earlier than 153.0.8010.53 and recommended updating to the current release. The notice did not identify CVEs, severity ratings, vulnerability types, or active exploitation.
CIRT.GY | Google Security Advisory (September 18th, 2026)
Sep 2026
Mozilla releases Firefox 156 and ESR security updates
Mozilla released Firefox 156 to remediate 73 vulnerabilities, including 29 rated high severity. The company also shipped corresponding fixes for Thunderbird 156 and 140.16 and Firefox ESR 153.3, 140.16, and 115.41; Mozilla reported no evidence of in-the-wild exploitation.
Chrome, Firefox Updates Patch 115 Vulnerabilities - SecurityWeek

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

44 linked

Sandboxed remote code execution in Google Chrome Input (CVE-2026-87542)Google Chrome WebPackaging Use-After-Free Sandbox Escape (CVE-2026-87639)Sandboxed code execution in Google Chrome Compositing (CVE-2026-91731)Cross-origin data disclosure through a race condition in Chromium Network (CVE-2026-91708)Sandbox Escape in Google Chrome Extensions on macOS (CVE-2026-91727)Sandboxed Code Execution via PDF Use-After-Free in Google Chrome (CVE-2026-91737)Out-of-sandbox memory disclosure in Google Chrome Skia (CVE-2026-91733)Sandboxed code execution via ServiceWorker type confusion in Google Chrome (CVE-2026-91715)CSS Observable Discrepancy Information Disclosure in Google Chrome (CVE-2026-91725)UI Spoofing in Chrome Transactions Platform (CVE-2026-91739)+34 more

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

21 references tracked. Mallory keeps watching after this page renders.

Ca CcsNews · Sep 18, 2026

Google security advisory (AV26-939) - Canadian Centre for Cyber SecurityOpen source ↗

Cryptika BlogNews · Sep 18, 2026

Chrome 153 Patches 16 Security Vulnerabilities Including Critical Dawn and WebGL Flaws | Cryptika CybersecurityOpen source ↗

Cyber Security NewsNews · Sep 18, 2026

Chrome 153 Patches 16 Security Vulnerabilities Including Critical Dawn and WebGL FlawsOpen source ↗

Csirt ItaliaNews · Sep 18, 2026

Risolte vulnerabilità in Google Chrome - ACNOpen source ↗

13 additional sources from 15-09-2026 to 17-09-2026

BugflationNews · Sep 8, 2026

Chrome 153 credits Big Sleep on an Input use-after-free - BugflationOpen source ↗

BugflationNews · Sep 8, 2026

Chrome 153 credits Codex Security on a WebPackaging use-after-free - BugflationOpen source ↗

Cirt GyNews · Sep 1, 2026

CIRT.GY | Google Security Advisory (September 17th, 2026)Open source ↗

Cirt GyNews · Sep 1, 2026

CIRT.GY | Google Security Advisory (September 18th, 2026)Open source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

widely-deployed-product-advisoryendpoint-software-vulnerability

Chrome 153 Patches 42 Flaws Including Three Critical Memory-Safety Bugs

Patch & Detection Intelligence · 21 sources · Updated 1mo ago · First seen Sep 16, 2026

Patch this, or something else?See real exploitation activity before you spend the cycle.

Triage this advisory

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

9 events · Sep 2026 – Sep 18, 2026

Sep 18, 20261mo ago
Canadian Cyber Centre issues Google advisory AV26-939
On September 18, 2026, the Canadian Cyber Centre issued advisory AV26-939, warning that Google was affected by unspecified vulnerabilities and referring users to Google's Stable Channel Update for Desktop. It recommended that users and administrators review the update information and apply necessary updates when available.
Google security advisory (AV26-939) - Canadian Centre for Cyber Security
Sep 17, 20262mo ago
Google releases Chrome 153.0.8010.52 security update
Google's September 17, 2026 stable-channel update remediated multiple vulnerabilities in Chrome versions earlier than 153.0.8010.52, including critical WebGL buffer-overflow CVE-2026-93372 and critical Dawn use-after-free CVE-2026-93374. The update also fixed high-severity PDFium and Extensions use-after-free flaws; no known public exploits were reported.
Google Chrome < 153.0.8010.52 Multiple Vulnerabilities | Tenable®
Sep 16, 20262mo ago
Canadian Cyber Centre issues Chrome advisory AV26-926
The Canadian Cyber Centre issued advisory AV26-926 stating that Google Chrome versions prior to 153.0.8010.48 are affected by unspecified vulnerabilities. It advised users and administrators to consult Google's Stable Channel Update information and apply available updates.
Google security advisory (AV26-926) - Malware News - Malware Analysis, News and Indicators
Sep 15, 20262mo ago
Chrome 153.0.8010.47 details additional Input and V8 vulnerabilities
Google's September 15, 2026 Chrome stable-channel advisory identified CVE-2026-91724, a high-severity Input use-after-free, and CVE-2026-91728, a high-severity V8 integer overflow. Affected macOS installations should upgrade to Chrome 153.0.8010.47 or later; the Nessus advisory reported no known exploits.
Google Chrome < 153.0.8010.47 Multiple Vulnerabilities | Tenable®
Sep 8, 20262mo ago
Chrome 153 fixes Input use-after-free CVE-2026-87542
Chrome 153 addressed CVE-2026-87542, a High-severity use-after-free vulnerability in Chrome's Input component. Google credited BigSleep@Grape with reporting the vulnerability.
Chrome 153 credits Big Sleep on an Input use-after-free - Bugflation
Sep 8, 20262mo ago
Chrome 153 fixes WebPackaging use-after-free CVE-2026-87639
Chrome 153 addressed CVE-2026-87639, a High-severity use-after-free vulnerability in the WebPackaging component. Google credited researcher “amyb,” working with OpenAI Codex Security, for reporting the issue.
Chrome 153 credits Codex Security on a WebPackaging use-after-free - Bugflation
Sep 8, 20262mo ago
Google releases Chrome 153 Stable security update
On September 8, 2026, Google released Chrome 153 to the Stable channel. The update addressed 42 reported vulnerabilities, including three Critical flaws—CVE-2026-91721, CVE-2026-91749, and CVE-2026-91726—and 27 High-severity issues; the advisory did not report active exploitation of the fixed flaws.
Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones
Reported Sep 1, 20262mo ago
Google advisory recommends Chrome 153.0.8010.53 or later
Google published a September 17, 2026 security advisory for vulnerabilities affecting Chrome versions earlier than 153.0.8010.53 and recommended updating to the current release. The notice did not identify CVEs, severity ratings, vulnerability types, or active exploitation.
CIRT.GY | Google Security Advisory (September 18th, 2026)
Sep 2026
Mozilla releases Firefox 156 and ESR security updates
Mozilla released Firefox 156 to remediate 73 vulnerabilities, including 29 rated high severity. The company also shipped corresponding fixes for Thunderbird 156 and 140.16 and Firefox ESR 153.3, 140.16, and 115.41; Mozilla reported no evidence of in-the-wild exploitation.
Chrome, Firefox Updates Patch 115 Vulnerabilities - SecurityWeek

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

44 linked

Do you run this?See real exploitation activity behind this advisory so you can triage it against everything else in the queue.

Prioritize This Patch

Source coverage

Sources

21 references tracked. Mallory keeps watching after this page renders.

Ca CcsNews · Sep 18, 2026

Google security advisory (AV26-939) - Canadian Centre for Cyber SecurityOpen source ↗

Cryptika BlogNews · Sep 18, 2026

Chrome 153 Patches 16 Security Vulnerabilities Including Critical Dawn and WebGL Flaws | Cryptika CybersecurityOpen source ↗

Cyber Security NewsNews · Sep 18, 2026

Chrome 153 Patches 16 Security Vulnerabilities Including Critical Dawn and WebGL FlawsOpen source ↗

Csirt ItaliaNews · Sep 18, 2026

Risolte vulnerabilità in Google Chrome - ACNOpen source ↗

13 additional sources from 15-09-2026 to 17-09-2026

BugflationNews · Sep 8, 2026

Chrome 153 credits Big Sleep on an Input use-after-free - BugflationOpen source ↗

BugflationNews · Sep 8, 2026

Chrome 153 credits Codex Security on a WebPackaging use-after-free - BugflationOpen source ↗

Cirt GyNews · Sep 1, 2026

CIRT.GY | Google Security Advisory (September 17th, 2026)Open source ↗

Cirt GyNews · Sep 1, 2026

CIRT.GY | Google Security Advisory (September 18th, 2026)Open source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Chrome 153 Patches 42 Flaws Including Three Critical Memory-Safety Bugs

How this story unfolded

Canadian Cyber Centre issues Google advisory AV26-939

Google releases Chrome 153.0.8010.52 security update

Canadian Cyber Centre issues Chrome advisory AV26-926

Chrome 153.0.8010.47 details additional Input and V8 vulnerabilities

Chrome 153 fixes Input use-after-free CVE-2026-87542

Chrome 153 fixes WebPackaging use-after-free CVE-2026-87639

Google releases Chrome 153 Stable security update

Google advisory recommends Chrome 153.0.8010.53 or later

Mozilla releases Firefox 156 and ESR security updates

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Chrome 153 Patches Actively Exploited V8 Flaw as Google Moves to Biweekly Releases

Chrome 156 Fixes 353 Vulnerabilities, Including Six Critical Flaws

Chrome Patches 37 Vulnerabilities, Including Seven Critical Memory-Safety Flaws

Chrome 153 Patches 42 Flaws Including Three Critical Memory-Safety Bugs

How this story unfolded

Canadian Cyber Centre issues Google advisory AV26-939

Google releases Chrome 153.0.8010.52 security update

Canadian Cyber Centre issues Chrome advisory AV26-926

Chrome 153.0.8010.47 details additional Input and V8 vulnerabilities

Chrome 153 fixes Input use-after-free CVE-2026-87542

Chrome 153 fixes WebPackaging use-after-free CVE-2026-87639

Google releases Chrome 153 Stable security update

Google advisory recommends Chrome 153.0.8010.53 or later

Mozilla releases Firefox 156 and ESR security updates

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Chrome 153 Patches Actively Exploited V8 Flaw as Google Moves to Biweekly Releases

Chrome 156 Fixes 353 Vulnerabilities, Including Six Critical Flaws

Chrome Patches 37 Vulnerabilities, Including Seven Critical Memory-Safety Flaws