Chrome 153 Update Patches 16 Vulnerabilities, Including Critical Dawn and WebGL Flaws

Key Takeaways

• Google has released Chrome 153, addressing 16 security vulnerabilities across Windows, macOS, and Linux.
• Two critical memory-safety flaws, CVE-2026-93374 in Dawn and CVE-2026-93372 in WebGL, are patched.
• Users are strongly advised to update immediately to mitigate risks of arbitrary code execution and memory corruption.
• The update also resolves eight high-severity issues and several medium and low-severity vulnerabilities.

Google has rolled out Chrome 153 to its Stable channel for desktop users, delivering crucial security updates that resolve 16 vulnerabilities. This release includes patches for two critical memory-safety flaws impacting the browser’s Dawn and WebGL components.

The updated versions are 153.0.8010.52/.53 for Windows and macOS, and 153.0.8010.52 for Linux distributions.

Critical Vulnerabilities Addressed

The most severe vulnerability patched in this release is CVE-2026-93374, a critical use-after-free flaw identified in Dawn. Dawn serves as Chrome’s implementation of the WebGPU graphics API. Use-after-free vulnerabilities occur when a program attempts to access memory after it has been deallocated, which can lead to memory corruption, browser crashes, or, in severe cases, arbitrary code execution via specially crafted web content.

Florian Schweitzer is credited with reporting the Dawn vulnerability to Google on April 8, 2026. The reward amount for this discovery has not yet been publicly disclosed by Google.

Another critical issue, CVE-2026-93372, involves a buffer overflow in WebGL. WebGL enables web applications to render interactive 2D and 3D graphics directly within the browser. A buffer overflow arises when an application writes data beyond the allocated size of a memory buffer, potentially overwriting adjacent memory and altering program execution flow, which attackers could exploit for malicious purposes.

Google’s internal security team identified the WebGL vulnerability on August 17, 2026. In line with standard security practices, Google has withheld technical details regarding both critical flaws. This approach aims to provide users sufficient time to apply the updates before exploit information becomes widely available to potential attackers.

High-Severity Flaws and Other Patches

Beyond the critical issues, Chrome 153 addresses eight high-severity vulnerabilities spanning various browser components:

• CVE-2026-93375: An incorrect reference resolution flaw in Tracing.
• CVE-2026-93382: A use-after-free vulnerability in PDFium.
• CVE-2026-93387: Improper state validation in Skia.
• CVE-2026-93373: A use-after-free bug affecting Extensions.
• CVE-2026-93381: A buffer overflow issue in PDFium.
• CVE-2026-93379: An incorrect authorization flaw in ORB.
• CVE-2026-93377: A type confusion vulnerability in the V8 JavaScript engine.

The type confusion flaw in V8 is particularly noteworthy due to V8’s role in processing JavaScript from websites. Such vulnerabilities can be exploited by attackers to manipulate the engine into misinterpreting object types, leading to memory corruption. This could potentially form part of a chain of vulnerabilities to achieve sandbox escapes.

The update also includes fixes for several medium- and low-severity vulnerabilities. These span components such as FileSystem, Omnibox, Permissions, DataTransfer, Storage, Paint, and WebAppInstalls, addressing issues like race conditions, server-side request forgery (SSRF), information leaks, out-of-bounds reads, authorization flaws, and UI spoofing.

Google has stated that it will keep bug details and related links restricted until the majority of Chrome users have updated their browsers. Restrictions may also remain in place if affected third-party libraries are utilized by other projects that have not yet released their own patches.

What You Should Do

• Update Immediately: All users should update their Chrome browser without delay. Navigate to the browser menu (three dots), select “Help,” then “About Google Chrome.” The browser typically downloads updates automatically but requires a restart to apply them.
• Prioritize Organizational Deployment: IT administrators in organizations should prioritize the deployment of this update across all managed endpoints. Browser vulnerabilities are a common attack vector, exploitable through routine web browsing, malicious advertisements, phishing attempts, and compromised legitimate websites.
• Verify Version: After updating, confirm that your Chrome version matches 153.0.8010.52/.53 (Windows/macOS) or 153.0.8010.52 (Linux).

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.