Google promoted Chrome 153 to the stable channel for Windows, Mac, and Linux on September 8, 2026. The update is rolling out gradually over the coming days and weeks. The Linux build is versioned 153.0.8010.36, while Windows and Mac ship as 153.0.8010.36/.37.

This release contains 230 security fixes.

Actively Exploited Vulnerability

Google says an exploit already exists in the wild for CVE-2026-87491, a Medium-severity out-of-bounds write vulnerability in V8, Chrome’s JavaScript engine.

Severity Breakdown

Based on the published list of fixes, the update addresses:

  • 5 Critical-severity vulnerabilities
  • 41 High-severity vulnerabilities
  • 127 Medium-severity vulnerabilities
  • 51 Low-severity vulnerabilities

Some details remain restricted until a majority of users have updated, or because the underlying issue lives in a third-party library shared with other projects.

Critical-Severity Fixes

  • Use after free in WebGL (CVE-2026-87464)
  • Use after free in WebGL (CVE-2026-87488)
  • Out of bounds write in WebGL (CVE-2026-87438)
  • Buffer overflow in WebGL (CVE-2026-87527)
  • Use after free in Cast (CVE-2026-87628)

High-Severity Fixes

The 41 High-severity fixes cover memory-safety and logic bugs across several components:

  • Multiple use-after-free and buffer-overflow issues in ANGLE (Chrome’s graphics abstraction layer)
  • Out-of-bounds read/write issues in WebGL
  • Use-after-free bugs in Views, Payments, Dawn, Receiver, Platform, and Input
  • Type confusion bugs in V8
  • A double-free bug in PDFium
  • Race conditions in Chromoting, Mobile, and the Updater
  • Authorization and injection issues in DevTools, Network, and WebUI
  • Memory corruption in Codecs
  • A use-after-free bug in Web Authentication

Medium and Low-Severity Fixes

The 127 Medium-severity and 51 Low-severity fixes touch a wide range of components, including:

  • Authorization and permission checks in FileSystem, Extensions, Downloads, ServiceWorker, CORS, Isolated Web Apps, and SiteIsolation
  • Information leaks in Navigation, Scroll, Passwords, ServiceWorker, and Core
  • UI misrepresentation and clickjacking issues in Downloads, FedCM, Geometry, and TrustedWebActivities
  • Use-after-free bugs in Browser, DevTools, Extensions, Aura, and Sharing
  • Improper input validation in Network, Safebrowsing, Interstitials, and WebRTC
  • A cross-site scripting issue in the Sanitizer API
  • Certificate-validation issues in Loader, CORS, and FedCM
  • Race conditions in DataTransfer and V8

How the Bugs Were Found

Google says many of the fixes in this release were caught internally using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL, alongside reports from external security researchers.

Availability

Chrome 153 is rolling out now and will reach all Windows, Mac, and Linux users over the next several days to weeks through Chrome’s normal update mechanism. Users can check their current version and trigger an update from Settings > About Chrome.