Google Chrome 153 Released With 230 Security Fixes and Zero-Day Exploited in the Wild
Google released Chrome 153 with 230 security fixes, patching CVE-2026-87491, a V8 out-of-bounds write zero-day actively exploited in the wild.
82
Vulnerability3 · 1 read
CVE-2026-87536
Use-after-free in Google Chrome V8 allows in-sandbox code execution via crafted HTML
- CVSS 3.1
- 8.8 high
- EPSS
- <1%p19
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-87536 is a use-after-free memory-safety flaw (CWE-416) in V8, the JavaScript and WebAssembly engine of Google Chrome, affecting builds prior to 153.0.8010.36. A remote attacker can trigger it by persuading a user to open a crafted HTML page, requiring no privileges but user interaction per the CVSS vector (AV:N/PR:N/UI:R). Successful exploitation allows the attacker to execute arbitrary code inside the Chrome sandbox, compromising the browser's content process, although the sandbox limits further access to the underlying operating system. Google rates the flaw High (CVSS 3.1: 8.8) and shipped the fix in Chrome 153.0.8010.36, part of a release containing 230 security fixes. News coverage of the release describes a zero-day exploited in the wild; while no public proof-of-concept is known and the CVE is not yet in CISA's KEV, defenders should treat active exploitation as likely given the in-the-wild reporting tied to this release.
What to do: Upgrade Google Chrome to 153.0.8010.36 or later on all endpoints (verify the version via chrome://settings/help) and enforce the update across managed fleets via enterprise update-management policies, since merely visiting attacker-controlled web content is the attack vector. Because V8 is shared across the Chromium ecosystem, expect Chromium-based browser vendors to follow with equivalent V8 fixes and apply those updates as they are released.
| Product | Affected |
|---|---|
| Google Chrome | all versions prior to 153.0.8010.36 (fixed in 153.0.8010.36) |
Estimated exposure
mass≈3 billion+ users (Chrome's global install base; every install on a pre-153.0.8010.36 build was vulnerable until auto-update) — Chrome is the world's dominant desktop browser with a publicly estimated 3+ billion users, and V8 is shared by every Chrome install, so effectively the entire user base was exposed at disclosure until Chrome's silent auto-update delivered…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)