The Chrome 153 update released on 15 September 2026 carries 42 security fixes, three of them rated critical. It moves the stable channel to 153.0.8010.47 on Windows, Mac, Linux and Android. A separate Chrome 153 build a week earlier carried 230 fixes and patched a zero-day already under attack.
What the 15 September Chrome Update Fixes
The 15 September build closes 42 flaws, and Google published every one of them by CVE number. Counting the entries in Google’s own release bulletin gives this breakdown.
| Severity | Number of fixes |
|---|---|
| Critical | 3 |
| High | 28 |
| Medium | 10 |
| Low | 1 |
| Total | 42 |
SecurityWeek, reviewing the same bulletin, reported the same three critical and 28 high-severity counts, and noted that 16 of the 42 came from researchers outside Google. Google listed only two reward amounts, $1,500 and $1,000, both for high-severity bugs; the three critical reports show no payment decided yet.
The version numbers are 153.0.8010.47 and .48 for Windows and Mac, and 153.0.8010.47 for Linux. Chrome for Android moved to 153.0.8010.47 on the same day and carries the same fixes.
The Three Critical Bugs in Build 8010.47
All three critical flaws are memory-safety bugs in parts of Chrome that handle untrusted web content. Google’s bulletin names them as follows:
- CVE-2026-91726: An out-of-bounds read in WebGL, the component that renders 3D graphics in a page. Reported by Google on 3 September 2026.
- CVE-2026-91721: A use-after-free in Internals. Reported by a researcher credited as xinyang on 4 September 2026.
- CVE-2026-91749: A use-after-free in Workers, which runs background scripts for a web page. Reported by Huynh Dinh Vu, credited as WinD39, on 8 September 2026.
A use-after-free bug lets code keep using memory the browser has already released, which attackers can sometimes turn into remote code execution. Google has not said whether any of the three has been used against real users, and its standard note applies: bug details stay restricted until most users have updated.
How to Check Your Chrome Version and Update
Chrome updates itself, but the fix only applies after a relaunch, so a browser left open for days can sit unpatched. Force the check rather than waiting.
- Open the three-dot menu at the top right of Chrome.
- Choose Help, then About Google Chrome.
- Chrome checks for an update as soon as that page opens and downloads it automatically.
- Click Relaunch. Open tabs are restored.
- Return to the same page and confirm the version reads 153.0.8010.47 or higher. On Windows and Mac, .48 is also current.
On Android, open Google Play, go to Manage apps and device, and update Chrome from there. One caveat matters: Google says the release “will roll out over the coming days/weeks”, so a machine that still reports an older build after a relaunch is waiting its turn, not broken.
Take the update only from Chrome itself or an official app store. Fake update prompts are a standing tactic, as our earlier report on a fake Chrome update aimed at Android users set out.
The Exploited Zero-Day Was in the Earlier Build
The flaw attackers were actually using is not in this week’s update. It was fixed on 8 September 2026, when Chrome 153 was promoted to stable as 153.0.8010.36/.37 with 230 security fixes.
That build addressed CVE-2026-87491, an out-of-bounds write in V8, the JavaScript and WebAssembly engine at Chrome’s core. Google rated it only Medium, but attached a line it uses sparingly: “Google is aware that an exploit for CVE-2026-87491 exists in the wild.”
The flaw was reported on 6 August 2026 by Jihyeon Jeong of the Compsec Lab at Seoul National University, who received a $2,500 reward. Chrome has been through this pattern before, as our coverage of an earlier critical Chrome exploit that forced an urgent update recorded. The Hacker News reported that the US Cybersecurity and Infrastructure Security Agency added it to the Known Exploited Vulnerabilities catalogue on 9 September 2026, giving federal civilian agencies until 23 September 2026 to patch. Google has not said who was exploiting it or against whom.
As of 17 September 2026, both fixes are shipping, and anyone on 153.0.8010.47 or later has the zero-day patch and the 42 newer fixes. Anyone still on 153.0.8010.36 has the zero-day patch but not the three critical bugs closed on 15 September.
Why Chrome Shipped Two Updates in Eight Days
This is the new normal rather than an emergency. The 8 September stable release of Chrome 153 began Chrome’s two-week release cycle, so security updates now land more often and in smaller batches.
That explains the confusing numbers in circulation. Reports citing 230 fixes and reports citing 42 are both correct: 230 belongs to the 8 September build, 42 to the 15 September one. Google also moved the Extended Stable channel, used mainly by managed business fleets, to 152.0.7977.130 on 15 September.
Firefox Users Have an Update Too
Mozilla shipped Firefox 156 in the same week with fixes for 73 vulnerabilities, 29 of them high severity, according to SecurityWeek. Thunderbird and the Firefox Extended Support Release builds received matching patches.
Between the two browsers that is 115 vulnerabilities closed in a single week, which is why several outlets covered the two releases together.
Chrome 153 Update FAQ
Which Chrome Version Am I Meant to Be On?
153.0.8010.47 or later, or .48 on Windows and Mac. Check it at Help, then About Google Chrome.
Was the Chrome Zero-Day Fixed in This Update?
No. CVE-2026-87491 was fixed on 8 September 2026 in build 153.0.8010.36/.37. The 15 September update adds 42 further fixes on top of it.
Does the Chrome 153 Update Cover Android Phones?
Yes. Chrome for Android moved to 153.0.8010.47 on 15 September with the same security fixes. Google’s desktop bulletin does not cover Chrome on Apple mobile devices, which follows its own release notes.
Do I Need to Do Anything if Chrome Says It Is Up to Date?
No, but check the number rather than the message. Google is rolling the build out in stages, so a browser can report itself up to date on an older version until the rollout reaches it.
What Do Critical and High Severity Mean Here?
They are Google’s own Chromium ratings for how much damage a flaw could do if exploited, not a measure of whether anyone is exploiting it. The one flaw known to be exploited this month was rated only Medium.
