FHN 
Google has released Chrome 153 for Windows, macOS, and Linux, fixing 16 security vulnerabilities, including two critical memory-safety bugs affecting Dawn and WebGL.
The new versions are:
- Windows: 153.0.8010.52/.53
- macOS: 153.0.8010.52/.53
- Linux: 153.0.8010.52
The two most serious vulnerabilities affect Chrome’s graphics technologies and could potentially allow malicious web content to cause memory corruption.
Critical Dawn and WebGL Vulnerabilities
The most serious issue is CVE-2026-93374, a critical use-after-free vulnerability in Dawn, Chrome’s implementation of the WebGPU graphics API.
A use-after-free occurs when software continues to access memory after that memory has already been released. In a browser, successful exploitation could potentially cause crashes, memory corruption, or arbitrary code execution through a specially crafted website or web application.
Security researcher Florian Schweitzer reported the Dawn vulnerability to Google on April 8, 2026. Google has not disclosed the reward associated with the report.
Chrome 153 also fixes CVE-2026-93372, a critical buffer overflow in WebGL. WebGL allows websites to display interactive 2D and 3D graphics directly in the browser.
A buffer overflow happens when a program writes more data into a memory area than it was designed to hold. An attacker could potentially use this to overwrite nearby memory and influence program execution.
Google’s internal security team reported the WebGL vulnerability on August 17, 2026.
Google has not published detailed technical information about either critical flaw. Keeping those details private gives users and organizations time to install the security update before information that could assist exploitation becomes widely available.
High-Severity Chrome Bugs
Chrome 153 also addresses eight high-severity vulnerabilities across several browser components.
The high-severity issues include:
- CVE-2026-93375 — Incorrect reference resolution in Tracing
- CVE-2026-93382 — Use-after-free in PDFium
- CVE-2026-93387 — Improper state validation in Skia
- CVE-2026-93373 — Use-after-free in Extensions
- CVE-2026-93381 — Buffer overflow in PDFium
- CVE-2026-93379 — Authorization flaw in ORB
- CVE-2026-93377 — Type confusion in V8
The V8 issue is particularly important because V8 is Chrome’s JavaScript engine and processes code from websites.
A type confusion vulnerability can cause the browser to incorrectly treat one type of object as another. Under the right conditions, this can lead to memory corruption and potentially become part of a larger browser exploitation chain.
Medium and Low-Severity Fixes
The remaining vulnerabilities affect several other Chrome components.
These include:
| CVE | Severity | Vulnerability | Component |
|---|---|---|---|
| CVE-2026-93380 | Medium | Race condition | FileSystem |
| CVE-2026-93384 | Medium | SSRF | Omnibox |
| CVE-2026-93383 | Medium | Information leak | Permissions |
| CVE-2026-93376 | Medium | Out-of-bounds read | DataTransfer |
| CVE-2026-93378 | Medium | Authorization flaw | Storage |
| CVE-2026-93385 | Medium | Information leak | Paint |
| CVE-2026-93386 | Low | UI spoofing | WebAppInstalls |
These bugs include race conditions, server-side request forgery, information disclosure, out-of-bounds memory reads, authorization weaknesses, and a user-interface spoofing issue.
Google said it will continue restricting technical details and related links until a large portion of Chrome users have installed the update. Some information may also remain restricted when affected third-party libraries are used by other projects that have not yet released their own fixes.
Update Chrome Now
Users should update Chrome as soon as possible.
To manually check for the update:
- Open Chrome.
- Select the three-dot menu.
- Go to Help → About Google Chrome.
- Allow Chrome to download and install the update.
- Restart the browser when prompted.
Chrome normally updates automatically, but the browser must be restarted before a downloaded security update becomes active.
For organizations, deploying the update across managed endpoints should be a priority. Browser vulnerabilities can be triggered during everyday activities such as visiting malicious websites, opening phishing pages, viewing compromised legitimate websites, or encountering malicious advertising.
Keeping browsers fully patched is therefore an important part of endpoint security and helps reduce the opportunity for attackers to turn a simple web visit into a security incident.
About the Author
