Google Chrome 153 Released With 230 Security Fixes and Zero-Day Exploited in the Wild
Google released Chrome 153 with 230 security fixes, patching CVE-2026-87491, a V8 out-of-bounds write zero-day actively exploited in the wild.
82
Vulnerability2 · 2 reads
CVE-2026-87579
Buffer Overflow in Google Chrome WebRTC Allows Sandboxed Code Execution
- CVSS 3.1
- 8.8 high
- EPSS
- <1%p36
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-87579 is a buffer overflow (CWE-122) in the WebRTC component of Google Chrome that is fixed in version 153.0.8010.36. It is triggered when a victim visits a crafted HTML page, which causes the malformed input to be processed by WebRTC and overflows a buffer. A successful attacker gains the ability to execute arbitrary code inside the Chrome renderer sandbox, which limits the blast radius of the compromise to the web-content sandbox rather than the whole system. All users running Google Chrome versions prior to 153.0.8010.36 are affected. As of this analysis there is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation risk at about 0.2%; note that the Chrome 153 release headline mentions a separately exploited zero-day, but the data does not tie that zero-day to this CVE.
What to do: Update Google Chrome to version 153.0.8010.36 or later, which is available via the Chrome update mechanism (chrome://settings/help). Until patched, avoid untrusted web pages that make heavy use of WebRTC, and confirm fleet versions via endpoint management or MDM reporting.
| Product | Affected |
|---|---|
| Google Chrome | All versions prior to 153.0.8010.36 |
Estimated exposure
masshundreds of millions to billions of users (Chrome's global install base) — Google Chrome is the world's dominant desktop browser with a user base on the order of billions, and users on any release before 153.0.8010.36 remain exposed until they update.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)