Google Issues Chrome 153 Security Update Addressing 42 Vulnerabilities Including Three Critical Flaws
Google has released a comprehensive security update for its Chrome browser, version 153, addressing a total of 42 vulnerabilities. The update, issued on September 15, 2026, includes three issues rated as Critical that could lead to remote code execution or memory corruption if exploited.
The company distributed the patched builds Chrome 153.0.8010.48 and 153.0.8010.47 for Windows and macOS, along with 153.0.8010.47 for Linux. The rollout will occur gradually over the coming days and weeks.
Critical Vulnerabilities Fixed
The three critical flaws resolved in this update are:
- CVE-2026-91726 — Out-of-bounds read vulnerability in WebGL
- CVE-2026-91721 — Use-after-free issue in Internals
- CVE-2026-91749 — Use-after-free vulnerability in Workers
These issues received the highest severity rating due to their potential impact on browser stability and security.
High-Severity Issues Addressed
In addition, Google fixed 28 high-severity vulnerabilities. Notable examples include an integer overflow in the V8 JavaScript engine (CVE-2026-91728), a use-after-free in V8 (CVE-2026-91745), an out-of-bounds write in ServiceWorker (CVE-2026-91711), and a type confusion flaw (CVE-2026-91715).
Other components such as Skia, DOM, PDF, Core, and Input received fixes for use-after-free conditions, race conditions, authorization bypasses, uninitialized resources, and type confusion errors. Ten medium-severity and one low-severity issue were also patched.
Related articles
LibreOffice and Apache OpenOffice Flaws Enable Remote Code Execution via Malicious Spreadsheets Without Macro Warnings
Two vulnerabilities, CVE-2026-63277 in LibreOffice Calc and CVE-2026-59265 in Apache OpenOffice, allow attackers to execute arbitrary code simply by tricking users into opening specially crafted spreadsheet files. The flaws exploit Java integration and class path handling, bypassing traditional macro security prompts entirely. LibreOffice has already released fixes in versions 26.2.5 and 26.8.0 that restrict class path entries to local file URLs only. Apache OpenOffice 4.1.16 and earlier remain vulnerable, with the stable patch expected in 4.1.17; interim mitigation requires disabling Java integration. The issues highlight risks in office suites that process untrusted documents containing external data connections or JDBC references. Organizations are advised to enforce least-privilege execution and avoid opening files from unknown sources until patches are applied.
Web Application Vulnerabilities Surge as AI-Driven Development Outpaces Security Testing
The number of vulnerabilities in web applications continues to grow each quarter, driven in part by the rapid adoption of artificial intelligence in software development pipelines. While integrating AI tools boosts productivity and shortens release cycles, many organizations fail to match this speed with equivalent security testing and validation processes. As a result, increasing amounts of code reach production environments without ever being assessed from an attacker’s perspective. Cybercriminals have quickly recognized this gap, exploiting repeated flaw patterns in applications that skip security reviews. The article emphasizes that pentesting must become a recurring part of the development cycle, conducted weekly or monthly to match the pace of updates. Continuous security testing allows teams to identify and remediate issues before they can be weaponized. Developing rapidly with AI is not inherently risky, but releasing unvalidated code transforms speed into exposure.
Microsoft Fixes CVE-2026-96940 in Exchange Server Allowing Authenticated Mailbox Access
Microsoft has patched CVE-2026-96940, a CVSS 8.8 vulnerability in Exchange Server that lets any authenticated user read other users' mailboxes without administrative rights. The flaw exposes full message content and attachments including contracts, spreadsheets, and sensitive documents. Affected on-premises versions include Exchange Server Subscription Edition RTM, Exchange 2016 CU23, Exchange 2019 CU15, and Exchange 2019 CU14. Exchange Online users are protected because the fix was applied server-side. Microsoft rates exploitation as likely but reports no confirmed attacks in the wild at disclosure time. The issue turns a single low-privilege credential into broad access to executive, legal, and financial correspondence.
New Spectre-v2 Variant Uses JIT Compiler Branch Target Reuse for Cross-Process Data Extraction
Researchers from the Netherlands and Italy have published a paper detailing a fresh Spectre-v2 attack that reuses branch predictor state instead of injecting new instructions. The technique leverages the JIT compiler cBPF inside the Linux kernel to train the branch target predictor, enabling speculative execution that leaks sensitive data such as hashed root passwords. Practical demonstrations extracted credentials from the su process in an average of three to five minutes on AMD, Intel, and ARM processors. Partial success was shown with SpiderMonkey in Firefox and GraalVM, although realistic end-to-end attacks were not achieved with those engines. The work also covers additional topics including forensic detection of attacks against 1C servers, a record Debian Linux kernel patch set, zero-day fixes in TeamViewer and Apple Core Graphics, and critical flaws in Dell Container Storage Modules.