Chrome V8 Zero-Day Exploited in Active Attacks: Update to Version 153 Now

Google is rolling out a major Chrome security update that fixes 230 vulnerabilities, including an actively exploited zero-day in the browser’s V8 JavaScript and WebAssembly engine.

Tracked as CVE-2026-87491, the vulnerability allows a malicious webpage to trigger an out-of-bounds write. Successful exploitation can execute attacker-controlled code inside Chrome’s sandbox, corrupt heap memory, expose information available to the renderer, or crash the browser.

As of September 9, 2026, Google has confirmed that an exploit exists in the wild. It has not identified the attackers, targeted organizations, delivery infrastructure, or objectives behind the campaign.

A Crafted HTML Page Can Corrupt V8 Memory

CVE-2026-87491 affects V8, the engine Chrome uses to process JavaScript and WebAssembly. The underlying weakness is an out-of-bounds write, a memory-safety error in which data is written beyond the limits of its intended buffer.

An attacker can reach the vulnerable code remotely through a specially prepared HTML page. The victim must process that attacker-controlled content, which could be delivered through a compromised website, malicious link, advertising chain, or another web-based mechanism. No specific delivery method has been disclosed for the observed attacks.

Writing outside an allocated buffer can alter adjacent heap structures and interfere with objects used by the browser process. Depending on the exploit, the immediate result could be a crash, unintended memory access, information exposure, or arbitrary code execution.

The reported execution context remains inside Chrome’s sandbox. That distinction matters: CVE-2026-87491 alone has not been described as a complete escape from the browser’s security boundary or a direct operating-system compromise.

Sandboxed code execution is still dangerous. It can give an attacker control over a renderer process and access to data exposed within that context. It could also become one component of a multi-vulnerability chain involving a separate sandbox-escape or privilege-escalation flaw. Google has not disclosed whether the active attacks use such a chain.

The company is withholding detailed technical information and exploit references while the update reaches users. Restrictions may remain in place if the same underlying problem also affects an unpatched third-party dependency.

Install Chrome 153.0.8010.36 or 153.0.8010.37

The fixed Stable Desktop versions are:

Operating system	Fixed Chrome version
Windows	153.0.8010.36
Linux	153.0.8010.36
macOS	153.0.8010.37

Google has warned that distribution may take days or weeks across its global user base. Automatic updating does not guarantee that the active browser process is protected: Chrome must be restarted after downloading the new build.

Users can initiate the process through:

More → Help → About Google Chrome → Relaunch

Organizations should verify the running version through browser inventory or endpoint-management platforms. Checking only whether an automatic-update policy exists can leave systems exposed when employees keep browser sessions open for long periods.

Google has not published a precise vulnerable-version boundary for CVE-2026-87491. Consequently, administrators should not attempt to determine safety from an older version range. The operational baseline is the fixed build listed for each platform.

Microsoft Edge, Brave, Opera, Vivaldi, and other Chromium-derived browsers may share affected components. Their vendors must package and distribute corresponding updates independently. Fixed version numbers for those browsers have not been disclosed.

Exploitation Is Confirmed, but Severity Remains Disputed

Public reporting assigns inconsistent severity labels to CVE-2026-87491. One classification describes it as medium severity, while another calls it high severity.

There is currently no verified NVD record providing an official CVSS score, CVSS vector, affected-product range, or CWE classification for this vulnerability. The out-of-bounds write has been associated with CWE-787, but that mapping has not been confirmed through an available NVD entry.

The same gap applies to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. A CISA KEV entry, addition date, and federal remediation deadline cannot currently be verified for CVE-2026-87491.

That absence of verified catalog data should not be mistaken for evidence that exploitation is theoretical. Google has independently confirmed in-the-wild use, making deployment of the fixed builds urgent regardless of the unresolved severity label.

Jihyeon Jeong of Compsec Lab at Seoul National University discovered and reported the issue to Google on August 6, 2026. Google awarded the researcher a $2,500 bug bounty.

The precise update-release day is unclear because published accounts conflict. One describes a Tuesday release and another a Thursday release. No separate exact rollout date has been established, although the patched Stable Desktop builds were available by September 9, 2026.

The Update Also Fixes Critical WebGL and Cast Bugs

CVE-2026-87491 is only one part of an unusually large Chrome release. The update addresses 230 vulnerabilities, including 195 issues identified by Google.

Five additional vulnerabilities have been classified as critical:

• CVE-2026-87464: use-after-free in WebGL
• CVE-2026-87488: use-after-free in WebGL
• CVE-2026-87438: out-of-bounds write in WebGL
• CVE-2026-87527: buffer overflow in WebGL
• CVE-2026-87628: use-after-free in Cast

The release also fixes CVE-2026-87639, a high-severity use-after-free vulnerability in WebPackaging credited to OpenAI Codex Security.

Several are memory-corruption flaws, including use-after-free conditions, buffer overflows, and out-of-bounds writes. Google uses AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL to identify these defect classes during browser development and testing.

No active exploitation has been reported for the other vulnerabilities listed above. Nevertheless, the presence of multiple critical memory-safety defects strengthens the case for deploying the entire update rather than treating it as a narrowly scoped V8 fix.

Chrome Has Faced a Series of Exploited Zero-Days

CVE-2026-87491 has been described as the seventh Chrome zero-day fixed since the start of the year, although published historical lists differ over which earlier vulnerability should be included.

The longer accounting comprises:

• CVE-2026-2441
• CVE-2026-3909
• CVE-2026-3910
• CVE-2026-5281
• CVE-2026-11645
• CVE-2026-85046
• CVE-2026-87491

Several of those earlier flaws have verified CISA KEV records. CVE-2026-2441 entered the catalog on 2026-02-17, with a federal remediation deadline of 2026-03-10. CVE-2026-3909 and CVE-2026-3910 were added on 2026-03-13, both carrying a 2026-03-27 deadline.

CVE-2026-5281 entered KEV on 2026-04-01, with remediation required by 2026-04-15. CVE-2026-11645 followed on 2026-06-09, with a 2026-06-23 deadline.

Each of those five vulnerabilities has a CVSS v3.1 score of 8.8 and requires user interaction. CISA’s mandated response is to apply vendor mitigations, follow applicable BOD 22-01 guidance for cloud services, or discontinue the affected product if mitigations are unavailable.

This history establishes a recurring pattern of real-world exploitation across Chrome components, including V8, Skia, CSS, and Dawn. It does not reveal who is exploiting CVE-2026-87491 or connect the current attacks to any earlier campaign.

What Security Teams Should Do Now

Enterprises should prioritize Windows and Linux endpoints below 153.0.8010.36 and macOS endpoints below 153.0.8010.37. Executive, developer, privileged-administrator, and high-risk browsing systems warrant accelerated deployment.

Security teams should also:

1. Force browser restarts after installing the update.
2. Validate effective versions through endpoint telemetry.
3. Track security releases from Edge, Brave, Opera, Vivaldi, and other Chromium vendors.
4. Investigate repeated renderer crashes or abnormal browser child processes.
5. Review web and network telemetry for suspicious HTML delivery.
6. Confirm remediation of the earlier Chrome vulnerabilities already present in CISA KEV.

No confirmed indicators of compromise, exploit hashes, malicious domains, victim sectors, or attacker identifiers are available. Detection efforts must therefore rely on behavioral evidence and local telemetry rather than a published IOC list.