Chrome 153 Patches 42 Vulnerabilities, Three of Them Critical: What They Mean and How to Update Today
Chrome 153 is out on the stable channel and it fixes 42 vulnerabilities, three of them critical. The worst one triggers when you open a purpose-built page and lets an attacker read memory outside the sandbox. Updating takes a minute.
What Chrome 153 Ships and Who It Reaches
Google shipped the update to the stable channel on September 15, 2026. It landed as 153.0.8010.47 and 153.0.8010.48 on Windows and macOS, and as 153.0.8010.47 on Linux. In total it fixes 42 vulnerabilities: three critical and 28 rated high severity, according to the tally the company publishes with each patch.
The Exact Versions: Windows, macOS and Linux
Windows and macOS machines get both suffixes from the same delivery; Linux gets a single one. If your version number is older than 153.0.8010.47, you do not have these security fixes yet.
42 Flaws Fixed: Three Critical and 28 High-Severity
The number matters less than how it is distributed. Several of the serious flaws live in components users touch without noticing, such as the graphics engine or the processes running background tasks. That is the group worth closing fast.
Read also
How to Check in 30 Seconds Whether You Are Up to Date
Open the browser menu and go to "About Google Chrome" (or type chrome://settings/help in the address bar). The browser will look for the update and, if it downloads it, ask you to restart. Until you restart, the patch is not active.
The Three Critical Bugs, in Plain Words
You do not need a course in exploitation to understand what got fixed; it is enough to know what class of bug each one is.
CVE-2026-91726: Out-of-Bounds Read in WebGL
This is the worst of the three. The advisory describes an out-of-bounds read in WebGL in Chrome on Android prior to 153.0.8010.47 that let a remote attacker read memory outside the sandbox through a crafted HTML page. In plain terms: the browser reads a memory area it does not own, and that read manages to leave the compartment meant to contain it.
CVE-2026-91721: Use-After-Free in Internals
A use-after-free happens when a program frees an object and then keeps using it. If someone plants their own data in that memory slot, they can steer what the process does. This one sits in Internals, the component that inspects the browser's internal state.
CVE-2026-91749: Use-After-Free in Workers
Same memory-management mistake, but in Workers: the threads that run code in parallel so the interface does not freeze. Bugs in Workers are delicate because they run with their own context and permissions.
What It Means When Google Rates Them Critical
On the Chromium scale, "critical" points to flaws that can undermine the browser's isolation without the victim doing anything elaborate. It is not a marketing label: it is the category the company reserves for what needs an immediate patch.
Why the WebGL Flaw Matters More Than It Sounds
WebGL Is Not a Detail: It Is the Door to 3D on the Web
WebGL is the API that draws 3D inside the browser: product viewers, configurators, interactive scenes, heavy charts. More and more web projects depend on it, which is why a flaw on that surface is not peripheral.
A Purpose-Built HTML Page Is Enough as a Vector
The awkward part is the vector: nothing has to be installed. It is enough for the person to open a prepared page. On a work machine, that turns any unknown link into a real risk while the version is out of date.
The Sandbox and Its Limits: Reading Memory Outside of It
The sandbox is the compartment where the browser locks each tab so a single flaw does not take down the whole system. When a memory read escapes that boundary, the problem stops being "the tab crashed" and becomes "the process reads data it should not".
The Other Half of the Cycle: Firefox
Chrome was not the only browser on the move: Mozilla published its own security update on September 15, 2026.
Mozilla's September 15 Security Update
The release notes for the ESR 115.41.0 branch carry that date. Mozilla keeps that branch only for older machines, such as Windows 7 and 8.1 or macOS 10.12 to 10.14, and recommends ESR 140 for everything else.
115 Vulnerabilities Across Both Browsers, per the Security Press Tally
Adding Chrome and Firefox together, the security press counts 115 vulnerabilities resolved in the same cycle. That is a media tally, not an official figure from Google or Mozilla: treat it as an order of magnitude rather than an exact number.
How to Check Your Firefox Version Without Guessing Numbers
Open the Firefox menu and go to "About Firefox". The browser will tell you whether it is up to date and download the update if needed. Avoid comparing against version numbers you read in a headline: the stable line and the ESR branches move in parallel.
Windows Had a Busy Week Too
Remote Desktop: The Out-of-Band Update Fixing What Patch Tuesday Broke
September's patches left Remote Desktop unstable: connection and sign-in failures over RDP, plus servers that stopped responding. Microsoft answered with an out-of-band update on September 15; for Windows 11 24H2 and 25H2 the relevant package is KB5129195.
Excel and Copy-Paste: The Bug Microsoft Already Acknowledged
In parallel, update KB5002914 breaks copy and paste in Excel, something the company has already acknowledged. If a team depends on Excel to operate, read the KB notes before applying it blindly in production.
The Lesson: Patch Fast, but Read the Notes Before Rebooting Everything
The two stories go together: security does not wait, but applying everything without reading can trade a security failure for a productivity one. Patch, then check what changed in critical services.
What to Check Before You Keep Working
Browser, OS and Extensions: The Everyday Attack Surface
These are the three surfaces people touch most and audit least. Updating browser and OS is the obvious step; reviewing installed extensions tends to be the eternal pending task.
Stale, Unmaintained Extensions: The Quiet Risk
An extension with no updates for months can read everything happening in your tabs. It is worth going through the list and removing what you no longer use: the thirty Chrome extensions that turned up with malware are a reminder that this already happened.
If You Manage Machines for a Team or a Client
Check the browser version on every workstation, not just your own. A single outdated machine is enough to make the rest of the patching largely pointless.
Conclusion
Chrome 153 fixes 42 vulnerabilities, three of them critical, including a WebGL memory read that fires just by opening the wrong page. Today's task is short: restart the browser, confirm the version and go through your extensions. If you want to keep shrinking your attack surface, we already covered how to pick free and safe app alternatives that do not harvest your data.
