Chrome 153 Fixes 230 Vulnerabilities, Including One 0-Day Exploited in the Wild
Google shipped Chrome 153 with 230 fixes, including CVE-2026-87491, a V8 out-of-bounds write zero-day exploited in the wild.
78
CVE-2026-87504
Use-After-Free in Chrome Core Allows Code Execution Outside the Sandbox
- CVSS 3.1
- 9.6 critical
- EPSS
- <1%p32
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-87504 is a use-after-free (CWE-416) in the Core component of Google Chrome, patched in Chrome 153.0.8010.36. A remote attacker triggers it by using social engineering to convince a victim to install or interact with a crafted Chrome extension, causing memory corruption in the browser's Core component. Successful exploitation yields arbitrary code execution outside Chrome's security sandbox, meaning the attacker gains control at the operating-system level rather than being confined to a renderer process. Everyone running Chrome before 153.0.8010.36 is affected, which in practice means nearly the entire Chrome install base. Chrome 153 shipped 230 vulnerability fixes, and related reporting indicates one of those fixes was a 0-day exploited in the wild; this issue has no known public proof-of-concept, is not in CISA KEV, carries a low 0.2% EPSS score, and was rated Medium by Chromium because exploitation requires user interaction.
What to do: Update Chrome to 153.0.8010.36 or later immediately via Settings > About Chrome (then relaunch the browser) and verify the version at chrome://version; enterprise administrators should force the update through browser management policies. Until patched, warn users against installing or enabling extensions from untrusted sources, since the attack chain relies on social engineering around a crafted extension.
| Product | Affected |
|---|---|
| Google Chrome | all versions prior to 153.0.8010.36 (fixed in 153.0.8010.36) |
Estimated exposure
mass≈3+ billion Chrome users/installs (Chrome holds roughly two-thirds of global browser market share) — Chrome's ~65% share of global browser usage implies an install base on the order of billions, essentially all of which remain vulnerable until they update to 153.0.8010.36.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Use after free in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)