Google Chrome 153.0.8010.36 Fixes Eight High-Severity Memory Safety Vulnerabilities

What Happened

Google released Chrome 153.0.8010.36 for desktop (and a corresponding iOS fix) to address eight separate memory-safety vulnerabilities identified in the browser: CVE-2026-87609 (use-after-free in Sharing, iOS), CVE-2026-87529 (numeric truncation error in Media), CVE-2026-87607 (use-after-free in Device, Mac), CVE-2026-87500 (improper array index validation in ANGLE), CVE-2026-87464 (use-after-free in WebGL, rated Critical by Chromium), CVE-2026-87650 (out-of-bounds read in WebGL), CVE-2026-87455 (use-after-free in Aura), and CVE-2026-87526 (use-after-free in Passwords, requiring social engineering and UI interaction). All were disclosed and fixed in the same vendor release.

Technical Cause

The vulnerabilities stem from several distinct memory-safety weaknesses: use-after-free conditions (CWE-416) in the Sharing, Device, WebGL, Aura, and Passwords components; a numeric truncation error (CWE-197) in Media; improper validation of an array index (CWE-129) in ANGLE; and an out-of-bounds read (CWE-125) in WebGL. Each flaw could, under the right conditions, allow a remote attacker to execute arbitrary code outside Chrome's security sandbox.

Why It Matters

All eight issues share a CVSS base score of 9.6, reflecting a network attack vector, low attack complexity, no privileges required, and high impact to confidentiality, integrity, and availability if exploited. Most require the victim to visit a crafted HTML page; CVE-2026-87526 additionally requires social engineering and UI interaction, and CVE-2026-87609 is triggered via crafted network traffic rather than a webpage. Chromium's own severity ratings range from Medium to Critical, with CVE-2026-87464 (WebGL use-after-free) rated Critical. No evidence of active exploitation or public proof-of-concept code has been reported for any of these issues.

Who Is Affected

Users and organizations running Google Chrome on desktop prior to version 153.0.8010.36 are affected by the majority of these issues. CVE-2026-87609 specifically affects Chrome on iOS prior to the same version, and CVE-2026-87607 specifically affects Chrome on Mac prior to the same version. Given Chrome's extremely broad installed base, the practical exposure is significant across consumer and enterprise environments alike.

Discovery and Timeline

Google published the Stable Channel update announcement on 2026-09-08, with the corresponding CVE records appearing in NVD on 2026-09-09. The fact package does not name any individual researchers or credit any discoverer, so no attribution is made in this report.

Affected Versions

All eight vulnerabilities affect Google Chrome versions prior to 153.0.8010.36. This is the single fixed version referenced across all vendor and database sources for this release.

Fixes and Mitigation

Google has shipped fixes for all eight vulnerabilities in Chrome version 153.0.8010.36. No workarounds or mitigations beyond updating to this version have been described in the available source material.

Recommended Action

Update Google Chrome to version 153.0.8010.36 or later as soon as possible. Chrome typically updates automatically on restart, but administrators managing fleets of devices should verify that the update has been applied, particularly on macOS and iOS deployments where device- and platform-specific fixes are included.