Google Chrome 153 Released With 230 Security Fixes and Zero-Day Exploited in the Wild
Google released Chrome 153 with 230 security fixes, patching CVE-2026-87491, a V8 out-of-bounds write zero-day actively exploited in the wild.
82
Vulnerability2 · 1 read
CVE-2026-87585
Double-Free in Google Chrome PDFium (Windows) Enables Sandbox-Confined Code Execution
- CVSS 3.1
- 8.8 high
- EPSS
- <1%p20
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-87585 is a double-free memory-corruption flaw (CWE-415) in the PDFium PDF rendering engine of Google Chrome on Windows. It is triggered when the browser opens a maliciously crafted PDF file, and a successful exploit allows a remote attacker to potentially execute arbitrary code inside Chrome's sandbox, limiting but not eliminating attacker access per the High CVSS impact ratings. All Chrome users on Windows running versions prior to 153.0.8010.36 are affected. No public proof-of-concept is known, the bug is not in CISA's KEV, and EPSS estimates only a ~0.2% probability of exploitation within 30 days. The fix is included in Chrome 153.0.8010.36 for Windows, a release with 230 security fixes that also addresses a separately reported zero-day exploited in the wild, though the headlines do not confirm whether that zero-day is this specific flaw.
What to do: Update Google Chrome on Windows to 153.0.8010.36 or later; verify the installed version via chrome://settings/help or chrome://version. As an interim mitigation, avoid opening PDFs from untrusted sources in Chrome or use a separate PDF reader until patched. Admins should push the updated build through their browser-management channels and note that Chrome 155 includes many other fixes, including a separately reported in-the-wild zero-day.
| Product | Affected |
|---|---|
| Google Chrome (PDFium) on Windows | All versions prior to 153.0.8010.36 on Windows |
Estimated exposure
masswell over 1 billion Chrome-on-Windows users (Chrome has a global desktop install base in the billions, with Windows accounting for the large majority of… — Chrome is the world's dominant desktop browser with a multi-billion-user install base, and the Windows-only scoping still leaves the affected population at the billion-user order of magnitude; the exact figure is an estimate and unknown.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)
In the news
2 storiesChrome 153 Fixes 230 Vulnerabilities, Including One 0-Day Exploited in the Wild
Google shipped Chrome 153 with 230 fixes, including CVE-2026-87491, a V8 out-of-bounds write zero-day exploited in the wild.
78