Chrome 153 Fixes 230 Vulnerabilities, Including One 0-Day Exploited in the Wild
Google shipped Chrome 153 with 230 fixes, including CVE-2026-87491, a V8 out-of-bounds write zero-day exploited in the wild.
78
Vulnerability2 · 2 reads
CVE-2026-87640
Out-of-Bounds Read in Chrome for Android WebView Enables Sandbox Memory Disclosure
- CVSS 3.1
- 6.1 medium
- EPSS
- <1%p13
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-87640 is an out-of-bounds read (CWE-125) in the WebView component of Google Chrome on Android, fixed in Chrome 153.0.8010.36. It is triggered when the browser renders a crafted HTML page, allowing an attacker who has already compromised the renderer process to read memory outside the sandbox. Successful exploitation results in information disclosure from memory outside the WebView sandbox; as a Medium-severity read bug, it does not by itself provide code execution or privilege escalation. Only Chrome on Android builds prior to 153.0.8010.36 are named in the advisory; other platforms are not listed as affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known for this specific flaw (EPSS 0.2%), though the same Chrome 153 release also patched a separate 0-day that is being exploited.
What to do: Update Chrome for Android to 153.0.8010.36 or later via the Google Play Store and enable automatic updates; verify the installed version at chrome://version. No workaround is available beyond patching, and defenders should ensure the full Chrome 153 rollup is applied since the same release fixed a separate 0-day exploited in the wild.
| Product | Affected |
|---|---|
| Google Chrome for Android (WebView component) | all versions prior to 153.0.8010.36 |
Estimated exposure
massbillions of Android devices/users (Chrome for Android has 1-5 billion+ Google Play installs) — Chrome for Android is the default or primary browser on the vast majority of Android devices with 1-5+ billion Play Store installs, so the installed base is in the billions, though practical exploitation additionally requires a prior…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Out of bounds read in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)