Google Issues Chrome 153 Security Update Addressing 42 Vulnerabilities Including Three Critical Flaws
Google has released a comprehensive security update for its Chrome browser, version 153, addressing a total of 42 vulnerabilities. The update, issued on September 15, 2026, includes three issues rated as Critical that could lead to remote code execution or memory corruption if exploited.
The company distributed the patched builds Chrome 153.0.8010.48 and 153.0.8010.47 for Windows and macOS, along with 153.0.8010.47 for Linux. The rollout will occur gradually over the coming days and weeks.
Critical Vulnerabilities Fixed
The three critical flaws resolved in this update are:
- CVE-2026-91726 — Out-of-bounds read vulnerability in WebGL
- CVE-2026-91721 — Use-after-free issue in Internals
- CVE-2026-91749 — Use-after-free vulnerability in Workers
These issues received the highest severity rating due to their potential impact on browser stability and security.
High-Severity Issues Addressed
In addition, Google fixed 28 high-severity vulnerabilities. Notable examples include an integer overflow in the V8 JavaScript engine (CVE-2026-91728), a use-after-free in V8 (CVE-2026-91745), an out-of-bounds write in ServiceWorker (CVE-2026-91711), and a type confusion flaw (CVE-2026-91715).
Other components such as Skia, DOM, PDF, Core, and Input received fixes for use-after-free conditions, race conditions, authorization bypasses, uninitialized resources, and type confusion errors. Ten medium-severity and one low-severity issue were also patched.
Related articles
Vulnerability Management in Atypical Environments: ICS, Networks, IoT, Mobile, Hardware, and ML Systems
Vulnerability management follows the same core process across environments—identify assets, scan, assess risk, prioritize, remediate, and verify—but each domain introduces critical constraints. In industrial control systems, scanning must avoid disrupting physical processes, requiring audit-mode authenticated scans, digital twins for testing, and strict change windows. Network devices frequently suffer from poor segmentation, default SNMP community strings, and exposed management interfaces that enable traffic redirection or configuration tampering. IoT ecosystems remain plagued by default credentials, as demonstrated by the Mirai botnet that took down major DNS infrastructure in 2016, while modern botnets like Reaper and VPNFilter exploit unpatched firmware at massive scale. Machine learning systems face novel threats including prompt injection, prompt leaking, and jailbreaking that can bypass safety controls or exfiltrate training data. Mobile platforms suffer from extreme fragmentation that prevents timely patching of vulnerabilities such as Stagefright, Pegasus, and BlueBorne. Hardware-level flaws like Spectre, Meltdown, and BadUSB demonstrate that even firmware and silicon require coordinated microcode, OS, and application updates.
Oracle Releases September 2026 Critical Security Patch Update Fixing 673 Issues Across Multiple Products
Oracle has published its monthly Critical Security Patch Update (CSPU) on September 15, 2026, delivering a total of 673 security fixes. The update addresses 672 unique CVEs after removing duplicates and targets a wide range of products including Oracle Database Server, Oracle Fusion Middleware, Oracle E-Business Suite, PeopleSoft, Siebel, and Oracle VM VirtualBox. Of the fixes, 607 received a CVSSv3 base score of 7.0 or higher, with 104 scoring 9.0 or above. Six vulnerabilities carry the maximum score of 10.0, while 15 are rated 9.9 and 44 are rated 9.8. Additionally, 247 of the issues can be exploited remotely without authentication. The CSPU serves as a smaller, more frequent complement to Oracle’s quarterly Critical Patch Update (CPU) releases.
Cisco Secure Email Gateway CVE-2026-76461 Critical SQL Injection Flaw Exploited in the Wild for Root Access
Cisco has confirmed active exploitation of CVE-2026-76461, a CVSS 9.8 critical SQL injection vulnerability in Secure Email Gateway. The flaw resides in AsyncOS mail parsing logic and allows unauthenticated attackers to execute arbitrary commands as root simply by sending a specially crafted email. No user interaction, authentication, or workarounds exist, leaving immediate patching as the only mitigation. Affected versions include all releases up to 15.5, 16.0, and 16.5; fixed builds are 15.5.5-014, 16.0.4-302, and 16.5.0-780. Because the gateway sits at the network perimeter with high privileges, successful compromise enables long-term email interception, lateral movement, and internal phishing campaigns. Organizations should examine mail_logs for patterns such as COPY.*TO PROGRAM and cross-check network telemetry for anomalous outbound connections.
How Modern API Attacks Abuse Legitimate Functionality Instead of Exploiting Vulnerabilities
Traditional API incidents once centered on authorization errors, access control issues, SQL injections, and known vulnerability exploitation. Today, many attacks on APIs no longer require finding code flaws; attackers simply use documented methods, valid authorization, and correct parameters at unexpected scale or timing. NGENIX security teams observe three main behavioral patterns: Burst attacks that overload resource-heavy endpoints, Shortwave attacks that exploit race conditions through timed parallel requests, and Carpet Bombing that distributes activity across dozens of endpoints for reconnaissance or scalping. These techniques often bypass WAF because each individual request appears fully compliant with API specifications. Protection is shifting toward behavioral analysis, sliding-window rate limiting, and monitoring of overall client behavior rather than single-request signatures. Real-world cases include sudden catalog scraping during contests and mass reservation of airline seats without purchases, leading to degraded service for legitimate users.