Google Chrome 153 Update Fixes 16 Security Flaws, Including Two Critical Vulnerabilities

Google has released Chrome version 153 to the Stable desktop channel, addressing 16 security vulnerabilities, including two critical-severity flaws affecting the Dawn graphics component and WebGL.

This update is rolling out as version 153.0.8010.52 for Windows and macOS. Linux users will receive version 153.0.8010.52 over the coming days and weeks.

Google Chrome 153 Update Fixes 16 Security Flaws

The most severe issue, tracked as CVE-2026-93374, is a use-after-free vulnerability in Dawn, Chromium’s implementation of the WebGPU API.

Use-after-free vulnerabilities occur when software continues to access memory after it has been released, potentially leading to crashes, memory corruption, or code execution under certain conditions. Florian Schweitzer reported this flaw to Google on April 8, 2026.

The second critical vulnerability, CVE-2026-93372, is a WebGL buffer overflow. Buffer overflow weaknesses can allow data to be written outside of an allocated memory boundary, which may cause browser crashes or enable more serious exploitation. Google reported this WebGL issue on August 17, 2026.

Both vulnerabilities affect graphics-related browser components that process potentially untrusted content from websites and web applications. While Google has not publicly disclosed technical exploit details, the critical severity rating makes prompt patching essential for organizations and individual Chrome users.

Chrome 153 also resolves seven high-severity vulnerabilities across multiple Chromium subsystems. These include a use-after-free flaw in PDFium, Chromium’s PDF rendering component, as well as a separate PDFium buffer overflow.

Attackers often target document-rendering functionality since malicious PDF files can be delivered through phishing emails, downloads, and compromised websites.

Other high-severity fixes include incorrect reference resolution in Tracing, improper state validation in Skia, a use-after-free issue in the Extensions component, incorrect authorization in ORB, and a type confusion flaw in the V8 JavaScript and WebAssembly engine.

Type confusion bugs in JavaScript engines are particularly significant because they can compromise memory safety when processing attacker-controlled web content.

The remaining fixes address six medium-severity flaws and one low-severity bug. The medium-severity issues include a race condition in FileSystem, server-side request forgery in Omnibox, an information leak in Permissions, an out-of-bounds read in DataTransfer, missing authorization in Storage, and an information leak in Paint.

Chrome 153 also corrects CVE-2026-93386, a low-severity UI misrepresentation flaw in WebAppInstalls. Such issues can potentially affect how users interpret installation prompts or browser interface elements, increasing the risk of social engineering abuse.

Administrators should prioritize deploying Chrome 153 across managed Windows, macOS, and Linux environments, especially because the release contains memory-safety flaws in browser-exposed graphics, PDF, extension, and JavaScript components.

Users can verify their installed version by navigating to the Chrome menu > Help > About Google Chrome. Chrome should automatically download the update, but a browser restart is required to activate the patched version.

Google noted that details about the vulnerabilities may remain restricted until most users have updated, a practice intended to reduce the likelihood of weaponization during the rollout period.

CVE Details

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC