Google Chrome Patches Eight High-Severity Vulnerabilities, Including Sandbox Escapes

What happened

Google published two Stable Channel updates for Chrome on desktop in September 2026. The first update (fixed in version 153.0.8010.47) addressed six vulnerabilities: an integer overflow in V8 (CVE-2026-91728), a use after free in Auth (CVE-2026-91716), a use after free in WebAppInstalls (CVE-2026-91710), a use after free in Workers (CVE-2026-91749), a use after free in Core (CVE-2026-91718), and improper input validation in ANGLE (CVE-2026-91738). A second update, fixed in version 153.0.8010.52, addressed two further vulnerabilities on Chrome for Android: a buffer overflow in WebGL (CVE-2026-93372) and a use after free in Dawn (CVE-2026-93374). In all cases Google describes exploitation as occurring via a crafted HTML page.

Technical cause

The vulnerabilities span several different root causes. Most (CVE-2026-91716, CVE-2026-91710, CVE-2026-91749, CVE-2026-91718, CVE-2026-93374) are use-after-free bugs (CWE-416), a memory-safety class where a program continues to reference memory after it has been freed, which an attacker can exploit to corrupt memory and potentially execute code. CVE-2026-91728 is an integer overflow (CWE-190) in V8, Chrome's JavaScript engine. CVE-2026-93372 is a buffer overflow (CWE-121) in WebGL. CVE-2026-91738 is an improper input validation issue (CWE-20) in ANGLE, Chrome's graphics translation layer. The affected components span V8, Auth, WebAppInstalls, Workers, Core, ANGLE, WebGL, and Dawn — a broad set of browser subsystems.

Why it matters

Chromium itself classifies the integer overflow in V8 (CVE-2026-91728) as allowing code execution inside the sandbox, while the remaining seven vulnerabilities are described as allowing (or potentially allowing) code execution outside the sandbox. A sandbox escape is particularly serious because it means a successful exploit is not confined to the restricted browser process and could affect the broader system. All issues require a user to visit or interact with a crafted HTML page, meaning user interaction is required, but no authentication is needed for exploitation.

Who is affected

All users of Google Chrome on desktop are affected by the six vulnerabilities fixed in version 153.0.8010.47. Users of Google Chrome on Android are additionally affected by the two vulnerabilities fixed in version 153.0.8010.52. Given Chrome's extremely large install base, the practical exposure is wide.

Discovery and timeline

Google published the first set of fixes on September 15, 2026 and the second set on September 17, 2026, both via its official Chrome Releases blog for the Stable Channel. The fact package does not include information identifying who reported these vulnerabilities.

Affected versions

Chrome on desktop prior to version 153.0.8010.47 is affected by CVE-2026-91728, CVE-2026-91716, CVE-2026-91710, CVE-2026-91749, CVE-2026-91718, and CVE-2026-91738. Chrome on Android prior to version 153.0.8010.52 is affected by CVE-2026-93372 and CVE-2026-93374. Specific earlier affected version ranges were not provided in the fact package.

Fixes and mitigation

Google has released fixes for all eight vulnerabilities. Desktop Chrome users should update to version 153.0.8010.47 or later. Chrome for Android users should update to version 153.0.8010.52 or later. No workarounds or mitigations other than updating are described in the available source material.

Recommended action

Update Google Chrome to the latest stable version as soon as possible. Chrome typically updates automatically, but users and administrators should verify the installed version is 153.0.8010.47 (desktop) or 153.0.8010.52 (Android) or newer, and restart the browser to apply the update. Given the sandbox-escape potential of several of these flaws, prompt patching is advised.