Chrome 153 Just Got 230 Security Fixes. The GPU Stack Is Getting Ugly

• The Mess: Google shipped Chrome 153 with 230 security fixes, including multiple critical WebGL bugs and a long list of high-severity memory-corruption flaws.
• The Damage: A malicious webpage can attack browser components handling graphics, media, V8 and other privileged processing paths.
• The Fix: Update Chrome immediately to the current Chrome 153 build and restart the browser.

Google’s September Chrome release is not a routine patch.

Chrome 153.0.8010.36 for Linux and 153.0.8010.36/.37 for Windows and macOS brings 230 security fixes. Google has also restricted some vulnerability details until enough users receive the update.

Several of the most interesting bugs sit in the browser’s graphics stack.

WebGL Is Taking Hits Again

The September bulletin lists several critical vulnerabilities in WebGL:

• CVE-2026-87464 — use-after-free
• CVE-2026-87488 — use-after-free
• CVE-2026-87438 — out-of-bounds write
• CVE-2026-87527 — buffer overflow

Another critical issue, CVE-2026-87628, affects Cast through a use-after-free.

The pattern matters.

WebGL takes data from webpages and feeds it into complicated graphics infrastructure sitting much closer to native browser code than ordinary HTML rendering.

Memory corruption in that territory can become far more serious than a broken page.

V8 Has More Problems

Chrome’s JavaScript engine also appears repeatedly in the September bulletin.

Among the high-severity issues are:

• CVE-2026-87587 — use-after-free in V8
• CVE-2026-87564 — type confusion in V8
• CVE-2026-87612 — type confusion in V8
• CVE-2026-87536 — use-after-free in V8

These are exactly the kinds of primitives attackers watch because JavaScript is available to every ordinary webpage.

A victim does not need to download an executable.

They may only need to visit a malicious site or load compromised advertising or third-party content.

ANGLE Is Another Large Attack Surface

The browser’s graphics translation layer is also heavily represented.

Google lists multiple high-severity ANGLE vulnerabilities, including use-after-free, out-of-bounds reads and writes, buffer overflow and improper array-index validation.

That produces an uncomfortable concentration around the browser’s path from web content to graphics APIs.

A browser is no longer just parsing markup.

It is processing JavaScript, video, WebGL commands, GPU resources, authentication interfaces, PDFs and increasingly complex web applications — all inside one security boundary.

Every one of those subsystems adds code.

One Earlier Chrome Exploit Is Already Confirmed

September’s update also arrives shortly after Google confirmed exploitation of CVE-2026-85046, a high-severity V8 type-confusion vulnerability disclosed in the September 3 stable update.

Google explicitly stated that an exploit for CVE-2026-85046 exists in the wild.

That makes the update cadence particularly important.

Attackers do not need every vulnerability in a massive bulletin.

One working exploit is enough.

Don’t Wait for the Browser to “Eventually” Update

Chrome updates progressively, but administrators should verify the actual installed version rather than assuming the browser has already restarted into the patched build.

For managed environments:

• enforce Chrome updates through enterprise policy;
• verify Chrome 153 deployment;
• restart browser processes where required;
• monitor endpoints that remain on older builds;
• pay particular attention to unmanaged Chromium-based installations.

For normal users, the answer is simpler:

Update Chrome. Restart it.

Bugstoday Opinion

Two hundred and thirty fixes sounds absurd until you remember how much operating-system functionality now lives inside a browser.

The interesting cluster isn’t the number.

It’s the recurring combination of WebGL, ANGLE, V8 and native memory corruption.

That is where browsers become attractive exploitation platforms.

Chrome remains heavily instrumented and aggressively patched. That’s good.

It also tells you something uncomfortable: the attack surface is enormous.

The safest browser is the patched one.

And the patched browser sitting in a tab that has been open for three weeks isn’t necessarily the browser you think it is.

Today’s Bugs. Tomorrow’s Breaches.

Technical Sources

• Google Chrome Releases — September 2026 Security Fixes
• Google Chrome Releases — Stable Channel Update for Desktop, September 8, 2026
• Google Chrome Releases — Stable Channel Update for Desktop, September 3, 2026
• Chromium Security
• NVD — Chrome CVE Records