Chrome 153 Patches 16 Security Vulnerabilities Including Critical Dawn and WebGL Flaws

Google has released Chrome 153 to the Stable channel for Windows, macOS, and Linux, addressing 16 security vulnerabilities, including two critical memory-safety flaws in Dawn and WebGL.

The update is rolling out as version 153.0.8010.52/.53 for Windows and macOS, while Linux users will receive version 153.0.8010.52.

The most severe issue, tracked as CVE-2026-93374, is a critical use-after-free vulnerability in Dawn, Chrome’s implementation of the WebGPU graphics API.

Use-after-free bugs occur when software continues accessing memory after releasing it. In browser environments, such flaws can potentially enable attackers to corrupt memory, crash the browser, or execute arbitrary code through a specially crafted website or web application.

Florian Schweitzer reported the Dawn vulnerability to Google on April 8, 2026. Google has not yet disclosed the reward amount associated with the report.

Chrome 153 Patches 16 Security Vulnerabilities

Chrome 153 also fixes CVE-2026-93372, a critical buffer overflow vulnerability in WebGL. WebGL lets websites render interactive 2D and 3D graphics directly in the browser.

A buffer overflow can occur when an application writes more data into a memory buffer than it can hold, potentially allowing malicious content to overwrite adjacent memory and alter program execution.

Google reported the WebGL issue internally on August 17, 2026. The company has not released technical details about either critical flaw, a common practice intended to give users time to install the update before exploit information becomes broadly available.

The release further addresses eight high-severity vulnerabilities across several Chrome components. These include an incorrect reference resolution flaw in Tracing, a use-after-free and buffer overflow issue in PDFium, improper state validation in Skia, a use-after-free bug affecting Extensions, incorrect authorization in ORB, and a type confusion vulnerability in the V8 JavaScript engine.

Type confusion flaws in V8 are particularly important because V8 processes JavaScript from websites. An attacker may attempt to exploit such a vulnerability by causing the engine to treat one kind of object as another, which can lead to memory corruption and potentially support browser sandbox escape chains when combined with additional vulnerabilities.

The remaining fixes cover medium- and low-severity issues in FileSystem, Omnibox, Permissions, DataTransfer, Storage, Paint, and WebAppInstalls.

These include a race condition, server-side request forgery, information leaks, an out-of-bounds read, missing authorization checks, and a UI misrepresentation issue.

Google said it will keep bug details and related links restricted until most Chrome users have updated. Restrictions may also remain in place when affected third-party libraries are used by other projects that have not yet issued fixes.

Users should update Chrome immediately by opening the browser menu, selecting Help, and then About Google Chrome. Chrome normally downloads updates automatically, but users must restart the browser to apply them.

Organizations should prioritize deployment across managed endpoints because attackers can exploit browser vulnerabilities through routine web browsing, malicious advertisements, phishing pages, and compromised legitimate websites.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Chrome 153 Patches 16 Security Vulnerabilities Including Critical Dawn and WebGL Flaws appeared first on Cyber Security News.