CERT-In warns of high-risk Chrome flaws on desktop

If Chrome on your office laptop has not restarted in a week, now is a good time. The Indian Computer Emergency Response Team (CERT-In) has issued a high-severity warning covering 16 security flaws in Google Chrome for desktop, and says a remote attacker could use them to run malicious code on a victim's machine.

The advisory, Vulnerability Note CIVN-2026-0474, carries an original issue date of 24 September 2026. It applies to Chrome versions older than 153.0.8010.52/.53 on Windows and Mac, and older than 153.0.8010.52 on Linux. Anyone on those builds is exposed.

What CERT-In found

The agency lists a wide spread of bugs across Chrome's internals. They include use-after-free errors in Dawn, PDFium and Extensions, buffer overflows in WebGL and PDFium, a type confusion flaw in the V8 JavaScript engine and a race condition in FileSystem.

Also on the list are a server-side request forgery issue in Omnibox, the browser's address bar, and information leaks in Permissions and Paint. Rounding it out are an out-of-bounds read in DataTransfer, missing authorisation in Storage and a UI misrepresentation bug in WebAppInstalls.

In plain terms, the attack described is simple. A victim is persuaded to open a specially crafted web request. If the exploit works, CERT-In says the attacker could execute arbitrary code, pull sensitive information, carry out spoofing, get around security restrictions or crash the system.

CERT-In has rated the risk as "high risk of unauthorized access to sensitive data, system compromise", with potential for remote code execution and denial of service. The note is addressed to all organisations and individuals using Chrome on desktop.

The advisory lists 16 CVE identifiers, running from CVE-2026-93372 to CVE-2026-93387. CERT-In does not say any of them are being exploited in the wild, and it does not assign individual severity scores in the note.

What users and IT teams should do

The fix is already out. CERT-In points users to Google's stable channel desktop update, which moves Chrome to version 153.0.8010.52 or .53. On most machines, opening the menu and going to Help and then About Google Chrome will trigger the download. The browser has to be relaunched for the patch to take effect, which is the step many people skip.

For companies, the job is larger. IT administrators managing fleets through group policy or device management tools should check that auto-update has not been blocked and that version reports match the patched build. Shared computers in offices, labs and cyber cafes are the usual laggards.

The note covers only the desktop browser. CERT-In has not described this particular advisory as applying to Chrome on Android or iPhone, though mobile users should keep apps updated as routine hygiene.

Browser warnings from CERT-In have become a regular feature in 2026, and it is easy to tune them out. This one deserves attention for a practical reason: the attack starts with a web request, and nearly every Indian office worker spends most of the day inside a browser tab. Patching takes a minute. Recovering a compromised machine takes far longer.

CERT-In, which works under the Ministry of Electronics and Information Technology, invites organisations to report incidents to it directly. Its contact details are listed at the end of the vulnerability note.