Google Chrome: 16 Vulnerabilities Including Critical Code Execution Flaws Patched Together
Google Chrome 153.0.8010.52 addresses 16 vulnerabilities, including critical flaws in Dawn, WebGL, and Extensions, patched on September 17, 2026.
Key findings
- Google Chrome 153.0.8010.52 patches 16 vulnerabilities disclosed on September 17, 2026.
- Three critical vulnerabilities, including use-after-free in Dawn and WebGL, could allow arbitrary code execution.
- High-severity flaws in PDFium, V8, Extensions, and Tracing also pose significant risks.
- Vulnerabilities include information leaks, UI misrepresentations, and access control bypasses.
- All 16 issues were addressed in a single browser update.
On September 17, 2026, Google released Chrome version 153.0.8010.52 (and 153.0.8010.53 for Windows and macOS) to address a batch of 16 security vulnerabilities. These vulnerabilities, disclosed on the same day, span various components of the browser, with several critical and high-severity flaws that could lead to arbitrary code execution and information disclosure.
The vulnerabilities have been grouped by their impact and affected components:
Memory Safety and Code Execution
A significant portion of the disclosed vulnerabilities are related to memory safety, with several allowing for arbitrary code execution.
CVE-2026-93382andCVE-2026-93377are high-severity issues in PDFium and V8, respectively, both allowing remote attackers to execute arbitrary code via crafted HTML pages.CVE-2026-93373, a critical use-after-free vulnerability in Extensions, could allow a remote attacker to execute arbitrary code through a crafted Chrome extension.CVE-2026-93374, a critical use-after-free in Dawn (Chrome's WebGPU implementation), andCVE-2026-93372, a critical buffer overflow in WebGL, both on Android, could allow remote attackers to execute arbitrary code. Florian Schweitzer reported the Dawn vulnerability.CVE-2026-93375, an incorrect reference resolution in Tracing on Windows, is a high-severity flaw that could allow a local attacker to execute arbitrary code.
Information Disclosure and UI Manipulation
Several vulnerabilities focus on information leaks and user interface misrepresentations.
CVE-2026-93385is an information leak in the Paint component, allowing remote attackers to obtain sensitive information.CVE-2026-93383is an information leak in Permissions, enabling remote attackers to leak cross-origin data.CVE-2026-93387involves improper state validation in Skia, allowing remote attackers to obtain cross-origin data.CVE-2026-93386, a UI misrepresentation in WebAppInstalls, could allow a remote attacker leveraging social engineering to spoof UI elements.
Access Control and Other Vulnerabilities
Other vulnerabilities include bypasses of access restrictions and race conditions.
CVE-2026-93379is an incorrect authorization flaw in ORB, allowing remote attackers to bypass site isolation.CVE-2026-93378andCVE-2026-93376are related to authorization and out-of-bounds reads, respectively, potentially leading to information disclosure or bypassing security restrictions.CVE-2026-93384is a server-side request forgery in Omnibox on Android, allowing attackers to bypass system access restrictions.CVE-2026-93380involves a race condition in FileSystem, which could allow attackers to bypass system access restrictions.
The update addresses all 16 vulnerabilities in a single release, with version 153.0.8010.52 being the primary patch. Users are strongly advised to update to the latest version to protect against these security risks. The disclosure of these vulnerabilities highlights the ongoing efforts to secure the complex components of modern web browsers.
The batch of vulnerabilities was disclosed on September 17, 2026, and patched in Chrome version 153.0.8010.52. The vulnerabilities span various components including WebAppInstalls, Permissions, ORB, Storage, DataTransfer, Tracing, and Extensions. All issues were addressed in a single Chrome version update. Cyber Security News Vypr Intelligence