On September 8, 2026, Google released the stable version of Chrome 153 (153.0.8010.36 for Linux, 153.0.8010.36/.37 for Windows and Mac) with fixes for 230 security vulnerabilities. This is one of the largest Chrome updates in recent times: it addresses 5 critical vulnerabilities, more than 40 high-severity issues, and dozens of medium-severity problems. The update affects all desktop platforms — Windows, Mac, and Linux. All users of Chrome and Chromium-based browsers are strongly advised to update as soon as possible.
Critical vulnerabilities: WebGL as the main target
Four out of five critical vulnerabilities are concentrated in the WebGL component — the API for rendering 3D graphics in the browser. This points to a systemic problem in this subsystem:
- CVE-2026-87464 — use after free in WebGL (discovered by Lexi Groves, $2,500 bounty)
- CVE-2026-87488 — use after free in WebGL (discovered by Google)
- CVE-2026-87438 — out of bounds write in WebGL (discovered by Google)
- CVE-2026-87527 — buffer overflow in WebGL (discovered by Google)
- CVE-2026-87628 — use after free in Cast (discovered by Hafiizh)
Use after free vulnerabilities allow an attacker to access a region of memory that has already been freed, which can lead to arbitrary code execution. Out of bounds write and buffer overflow are classic memory handling errors that likewise open a path for executing an attacker’s code. Three of the four critical WebGL vulnerabilities were discovered by Google itself, indicating intensive internal auditing of this component.
High-severity vulnerabilities
The list of High-level vulnerabilities spans a wide range of Chrome components. Among the most notable are:
Issues in the graphics stack (ANGLE, WebGL, GPU, Dawn): Numerous vulnerabilities — out of bounds read and write, buffer overflow, use after free, uninitialized resources — affect the graphics-processing components. These include CVE-2026-87512 (use after free in ANGLE), CVE-2026-87654 (buffer overflow in ANGLE), CVE-2026-87621 (out of bounds write in ANGLE), CVE-2026-87650 (out of bounds read in WebGL). Such a concentration of issues in the graphics stack makes it a priority attack surface.
Vulnerabilities in the V8 engine: Two type confusion vulnerabilities (CVE-2026-87564 and CVE-2026-87612) and two use after free issues (CVE-2026-87587 and CVE-2026-87536) were discovered. Type confusion vulnerabilities in V8 have historically been among the most exploited in real-world attacks. We have already written about a critical type confusion vulnerability in V8 that was exploited as a zero-day.
Other components: Use after free issues were fixed in Payments (CVE-2026-87558, CVE-2026-87581, CVE-2026-87474), Web Authentication (CVE-2026-87646), Platform (CVE-2026-87460), as well as an injection in DevTools (CVE-2026-87572), memory corruption in Codecs (CVE-2026-87444), and authorization errors in Network (CVE-2026-87447).
Involvement of AI systems in vulnerability discovery
Two reports are particularly noteworthy: CVE-2026-87542 (use after free in Input), discovered by Google BigSleep@Grape, and CVE-2026-87639 (use after free in WebPackaging), discovered by OpenAI Codex Security (amyb). This demonstrates the growing role of AI tools in vulnerability discovery — both Google’s internal systems and external ones.
Medium-severity vulnerabilities: broad component coverage
Among the dozens of medium-severity vulnerabilities, several categories stand out:
- Authorization and isolation issues — bugs in SiteIsolation, CORS, FileSystem, Extensions, ServiceWorker. Numerous “missing authorization” and “incorrect authorization” vulnerabilities highlight the complexity of Chrome’s permission model
- Information leaks — in ServiceWorker, Navigation, Downloads, CORS, Extensions, Enterprise
- UI issues — numerous UI misrepresentation cases in Downloads, Payments, FedCM, Geometry, Session, UrlFormatting. These vulnerabilities can be used for phishing and deceiving users
- CVE-2026-87478 — observable discrepancy in Autofill, notable in that the bug was filed back in August 2022, meaning it remained open for more than four years
Impact assessment
The scale of the update — 230 fixes — is unprecedented for a single Chrome release. The critical vulnerabilities in WebGL pose the greatest threat: WebGL is actively used on sites with 3D content, in browser games, mapping services, and data visualization tools. Exploitation can occur simply by visiting a malicious web page without any additional user interaction.
V8 vulnerabilities (type confusion and use after free) have traditionally been a vector for sandbox escapes and arbitrary code execution. As of the time of publication, exploitation status of the listed vulnerabilities has not been confirmed as active, but the presence of type confusion in V8 always requires heightened attention.
Recommendations
- Immediately update Chrome to version 153.0.8010.36 (Linux) or 153.0.8010.36/.37 (Windows/Mac). The update is available via the “Help → About Google Chrome” menu or will be installed automatically
- Update all Chromium-based browsers — Microsoft Edge, Brave, Opera, Vivaldi — to their corresponding versions as soon as they become available
- For corporate environments: prioritize deploying the update given the critical vulnerabilities in WebGL. If immediate updating is not possible, consider temporarily disabling WebGL via the
--disable-webglpolicy - Check the browser version on all workstations — Google notes that rollout will take place gradually over several days
Given the 5 critical vulnerabilities with potential for remote code execution and dozens of high-severity issues in the graphics stack and V8, updating to Chrome 153 should be treated as a top priority. Organizations using Chromium-based browsers need to monitor the release of corresponding patches from vendors and apply them without delay.
