Google pushed another Chrome update to the stable channel on 15 September, one week after the release that carried a flaw attackers were already using. This one is 153.0.8010.47/.48 on Windows and Mac and 153.0.8010.47 on Linux, and it closes 42 security bugs, three of them rated Critical.
Nothing in this batch is described as being under attack. That is what separates it from the release it follows, and it is why this is a routine update rather than an emergency.
Three criticals in three different corners
The critical trio does not cluster. CVE-2026-91726 is an out of bounds read in WebGL, the component that draws 3D graphics on a web page. CVE-2026-91721 and CVE-2026-91749 are both use after free bugs, one in Internals and one in Workers; a use after free means the browser goes on using a piece of memory it has already given back, which is a well worn foothold for anyone who can control what lands there next. Google credits xinyang for the Internals flaw and WinD39 (Huynh Dinh Vu) for the one in Workers, and found the WebGL bug itself.
Detail beyond that is deliberately thin, and will stay that way for a while. Google's release announcement repeats its standing note that access to bug details and links may be kept restricted until most users have updated, and held longer still when the flaw sits in a third party library that other projects also depend on.
A small batch that leans hard on High
Below the criticals the shape is unusual: 28 of the 42 fixes are rated High, against 10 Medium and a single Low. Chrome 153's first stable build, which shipped on 8 September, was much flatter, with 5 critical and 41 high inside a list of 230 fixes. This is a smaller and more concentrated batch, not a worse one.
One name recurs. Jihyeon Jeong of the Compsec Lab at Seoul National University, listed as a research intern, is credited with two bugs here: an integer overflow in V8, the engine that runs JavaScript inside Chrome, and a type confusion flaw in ServiceWorker. Jeong also reported CVE-2026-87491, the V8 bug Google confirmed was being exploited in the wild when Chrome 153 first shipped, and which followed another exploited Chrome flaw days earlier.
Edge users are not covered yet
Chromium fixes reach Microsoft Edge on Microsoft's own timetable, and it has not caught up. The entry dated 15 September in Microsoft's Edge security release notes says only that Microsoft "is aware of the recent Chromium security fixes" and is "actively working on releasing a security fix". The newest Edge Stable build listed there is 153.0.4234.32, from 10 September. Hong Kong's HKCERT, which relayed the Chrome release to its constituents in a 16 September bulletin and rated it Medium Risk, issued a separate Edge bulletin the same day.
Update to 153.0.8010.47, then actually restart
Windows and Mac need 153.0.8010.47 or .48, Linux 153.0.8010.47. Google says the build "will roll out over the coming days/weeks", so it may not be offered to every machine at once, and Chrome finishes applying an update only after a restart. A browser left open for a fortnight is still running the old code however much it has quietly downloaded, which is the gap most people never close on their own machines.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.