Loading story…
Google released Chrome 153 to the Stable channel, fixing 42 security vulnerabilities, including three Critical memory-safety flaws: use-after-free vulnerabilities in Internals (CVE-2026-91721) and Workers (CVE-2026-91749), plus an out-of-bounds read in WebGL (CVE-2026-91726). The update also addresses 27 High-severity issues affecting components including V8, ServiceWorker, Core, Extensions, Skia, ANGLE, PDF, WebPackaging, and Input. High-severity use-after-free bugs include CVE-2026-87639 in WebPackaging, reported by amyb of OpenAI Codex Security, and CVE-2026-87542 in Input, reported by BigSleep@Grape.
Google has not reported active exploitation of any of the fixed vulnerabilities and withheld technical exploit details. Organizations should deploy Chrome 153.0.8010.47/.48 on Windows and macOS or 153.0.8010.47 on Linux, confirm managed endpoints have completed the update and restarted the browser, and investigate devices delayed by update policies or incomplete rollout.
See real exploitation activity before you spend the cycle.
9 events from the most recent confirmed update back to the earliest known activity.
On September 18, 2026, the Canadian Cyber Centre issued advisory AV26-939, warning that Google was affected by unspecified vulnerabilities and referring users to Google's Stable Channel Update for Desktop. It recommended that users and administrators review the update information and apply necessary updates when available.
Google's September 17, 2026 stable-channel update remediated multiple vulnerabilities in Chrome versions earlier than 153.0.8010.52, including critical WebGL buffer-overflow CVE-2026-93372 and critical Dawn use-after-free CVE-2026-93374. The update also fixed high-severity PDFium and Extensions use-after-free flaws; no known public exploits were reported.
The Canadian Cyber Centre issued advisory AV26-926 stating that Google Chrome versions prior to 153.0.8010.48 are affected by unspecified vulnerabilities. It advised users and administrators to consult Google's Stable Channel Update information and apply available updates.
Google's September 15, 2026 Chrome stable-channel advisory identified CVE-2026-91724, a high-severity Input use-after-free, and CVE-2026-91728, a high-severity V8 integer overflow. Affected macOS installations should upgrade to Chrome 153.0.8010.47 or later; the Nessus advisory reported no known exploits.
Chrome 153 addressed CVE-2026-87542, a High-severity use-after-free vulnerability in Chrome's Input component. Google credited BigSleep@Grape with reporting the vulnerability.
Chrome 153 addressed CVE-2026-87639, a High-severity use-after-free vulnerability in the WebPackaging component. Google credited researcher “amyb,” working with OpenAI Codex Security, for reporting the issue.
On September 8, 2026, Google released Chrome 153 to the Stable channel. The update addressed 42 reported vulnerabilities, including three Critical flaws—CVE-2026-91721, CVE-2026-91749, and CVE-2026-91726—and 27 High-severity issues; the advisory did not report active exploitation of the fixed flaws.
Mozilla released Firefox 156 to remediate 73 vulnerabilities, including 29 rated high severity. The company also shipped corresponding fixes for Thunderbird 156 and 140.16 and Firefox ESR 153.3, 140.16, and 115.41; Mozilla reported no evidence of in-the-wild exploitation.
Google published a September 17, 2026 security advisory for vulnerabilities affecting Chrome versions earlier than 153.0.8010.53 and recommended updating to the current release. The notice did not identify CVEs, severity ratings, vulnerability types, or active exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
21 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourceacn.gov.it
Open sourcebugflation.com
Open sourcebugflation.com
Open sourcecirt.gy
Open sourcecirt.gy
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released Chrome 153 for Windows, macOS, Linux, Android, and iOS, fixing 230 reported security vulnerabilities, including **CVE-2026-87491**, an out-of-bounds write in the V8 JavaScript and WebAssembly engine that is reportedly being exploited in the wild. The release includes five critical and 43 high-severity fixes across WebGL, Cast, ANGLE, PDFium, V8, and WebView; organizations should prioritize updating managed browsers to `153.0.8010.36` or later. Google has formally reduced Chrome's stable release cycle from four weeks to two weeks, aiming to shorten the N-day window between public disclosure of a flaw and deployment of a patch. The company cited a growing volume of reports and automated AI-assisted security work, alongside faster-moving AI-enabled threats, as drivers for the accelerated cadence; the schedule will also speed delivery and iteration of Chrome features, including AI capabilities.
Sep 10, 2026
Google released Chrome 154 for Windows, macOS, and Linux, fixing **108 vulnerabilities**, including 11 critical memory-safety defects that malicious web content could potentially exploit for crashes, information disclosure, or attacker-controlled code execution. The critical issues include buffer overflows, out-of-bounds writes, and use-after-free conditions in ANGLE, WebGL, GPU components, ServiceWorker, Fullscreen, WindowDialog, and AdFilter. Updated builds are rolling out as `154.0.8037.57` for Linux and `154.0.8037.57/.58` for Windows and macOS. The release also addresses browser-boundary and data-exposure weaknesses affecting V8, WebGPU, CORS, credential previews, extensions, DevTools, WebView, WebNFC, DRM capture controls, Android WebAPKs, and the macOS updater. Notable fixes prevent cross-origin GPU shader and framebuffer-memory disclosure, a CORS preflight-cache bypass that could enable blind CSRF-style state changes, cross-domain username leakage from grouped credentials, extension isolated-world boundary breaches, DevTools privilege escalation, and a Qualcomm GPU-driver-triggered write crash. Organizations should expedite Chrome updates across managed endpoints and ensure separately deployed Google Updater components are current on macOS.
Sep 29, 2026
Google released Chrome Stable **154.0.8037.92/.93** for Windows and macOS and **154.0.8037.92** for Linux, remediating 32 security vulnerabilities. The most severe issue, **CVE-2026-102331**, is a critical buffer overflow in ANGLE that can corrupt memory and potentially enable code execution in Chrome’s browser context. The update also fixes 26 high-severity issues, including V8 type-confusion and buffer-overflow flaws potentially reachable through malicious webpages, along with use-after-free, out-of-bounds, and uninitialized-resource bugs. Affected components include GPU, WebGPU, Mojo, Bluetooth, Passwords, WebUI, CORS, Payments, WebView, and SiteIsolation. Google is restricting some technical details until adoption increases; it reported no active exploitation and advised users to update and relaunch Chrome promptly.
Oct 7, 2026