Google Patches Two Critical Chrome Flaws That Enable Code Execution

Google released Chrome security updates on 17 September 2026 to address 16 vulnerabilities. The flaws include two described as critical: CVE-2026-93374, a use-after-free issue in the Dawn graphics library, and CVE-2026-93372, a buffer overflow in WebGL. Both could potentially cause memory corruption and allow arbitrary code execution. Other high-severity vulnerabilities affect the V8 JavaScript engine, Skia graphics and PDFium, including CVE-2026-93377, a type-confusion flaw in V8. The article says there is no confirmed exploitation in the wild and no publicly available proof-of-concept code.

The affected releases are Chrome versions before 153.0.8010.52 on Linux, and versions earlier than 153.0.8010.52/.53 on Windows and macOS. Google fixed the listed CVEs — including CVE-2026-93374, CVE-2026-93372, CVE-2026-93377, CVE-2026-93382 and CVE-2026-93381 — in version 153.0.8010.52. Users can check for the update through Chrome’s Help > About Google Chrome menu and restart the browser to complete installation. Google said access to detailed bug information may remain restricted until most users have installed the fix.