Google shipped Chrome 153 with 230 fixes, including CVE-2026-87491, a V8 out-of-bounds write zero-day exploited in the wild.
Chrome 153 (153.0.8010.36/.37) rolls out to Windows, Mac, and Linux with 230 security fixes, among the largest patch batches in recent Chrome history. The headline flaw is CVE-2026-87491, a Medium-severity out-of-bounds write in the V8 JavaScript and WebAssembly engine that Google confirmed is exploited in the wild; it was reported by Jihyeon Jeong of Compsec Lab at Seoul National University for a $2,500 bounty. The release also closes five Critical-rated flaws, including CVE-2026-87464, CVE-2026-87488, CVE-2026-87438, CVE-2026-87527, and CVE-2026-87628, mostly use-after-free and out-of-bounds write bugs in WebGL and Cast, plus 43 High-severity issues across ANGLE, PDFium, V8, DevTools, and Payments. Several bugs were surfaced with AI-assisted discovery tools, including OpenAI's Codex Security team, and top bounties reached $5,000 for CVE-2026-87504.
Actively Exploited Out-of-Bounds Write in Google Chrome V8
CVE-2026-87491 is an out-of-bounds write (CWE-787) in the V8 JavaScript engine in Google Chrome, fixed in Chrome 153.0.8010.36, which Google shipped alongside roughly 230 other security fixes. An attacker can trigger the flaw remotely by luring a user (user interaction required) into opening a crafted HTML page that corrupts memory in V8. Successful exploitation allows the attacker to execute arbitrary code inside the Chrome browser sandbox, which constrains but does not eliminate the impact. All Google Chrome users running versions prior to 153.0.8010.36 are affected; because the flaw resides in V8, CISA tracks it as 'Google Chromium V8', and other Chromium-based browsers may inherit the fix in their own updates. The flaw is being actively exploited in the wild — it is the seventh actively exploited Chrome zero-day of 2026 and was added to CISA's KEV catalog on 2026-09-09 — though no public proof-of-concept is known and ransomware use is unknown.
· Google Chrome (V8 JavaScript engine; tracked by CISA as 'Google Chromium V8') prior to 153.0.8010.36 KEVmass
Use-After-Free in WebGL in Google Chrome Allows Code Execution Outside the Sandbox
CVE-2026-87464 is a use-after-free (CWE-416) in the WebGL component of Google Chrome affecting versions prior to 153.0.8010.36. A remote attacker can trigger it by luring a user to open a crafted HTML page, which corrupts memory in the browser's WebGL rendering path. Successful exploitation allows arbitrary code execution outside the browser sandbox, meaning the attacker escapes Chrome's process isolation and runs code with the privileges of the browser on the host. All Chrome users running an unpatched version before 153.0.8010.36 are affected. As of now there is no public proof-of-concept and this specific flaw is not in CISA KEV, although the Chrome 153 release headlines reference a separate V8 zero-day that was exploited in the wild.
· google chrome all versions prior to 153.0.8010.36mass
Heap Buffer Overflow in Google Chrome WebGL Enables RCE Outside the Sandbox
CVE-2026-87527 is a buffer overflow (CWE-122) in the WebGL component of Google Chrome that is triggered when a user visits a crafted HTML page, requiring no authentication and no special privileges. Successful exploitation allows a remote attacker to execute arbitrary code outside the browser sandbox, meaning the attacker breaks out of Chrome's core containment boundary — a high-impact outcome reflected in its Critical Chromium severity and 9.6 CVSS score. All users running Google Chrome versions prior to 153.0.8010.36 are affected. As of this analysis there is no public proof of concept, the flaw is not in CISA's KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days; the zero-day exploited in the wild cited in related headlines is a separate V8 issue also fixed in the Chrome 153 release. Defenders should nonetheless treat this as high priority given the severity, the attack's web-browsing trigger, and the sandbox-escape impact.
· Google Chrome All versions prior to 153.0.8010.36mass
Use-After-Free in Google Chrome ANGLE Allows Code Execution Outside Sandbox on Windows
CVE-2026-87512 is a use-after-free (CWE-416) in ANGLE, the graphics translation layer Chrome uses for WebGL, in Google Chrome on Windows; Chromium rates it High and CVSS 3.1 scores it 9.6 (critical). It is triggered when the browser processes a crafted HTML page, which requires user interaction such as visiting an attacker-controlled site, and it lets the attacker execute arbitrary code outside the Chrome sandbox, i.e., escape from the web-content sandbox. Any Chrome user on Windows running a version before 153.0.8010.36 is affected; other platforms are not named in the advisory. The CVE record lists no public proof-of-concept and the flaw is not yet in CISA KEV, but reporting on the Chrome 153 release (230 security fixes) indicates a zero-day exploited in the wild was patched in the same release, so defenders should treat active exploitation as plausible. EPSS currently estimates only a 0.4% probability of exploitation within 30 days (29th percentile), so patching urgency is driven by the bug's severity and the reported in-the-wild zero-day in this release.
· google chrome All Google Chrome releases on Windows prior to 153.0.8010.36mass
Use-After-Free in Chrome Core Allows Code Execution Outside the Sandbox
CVE-2026-87504 is a use-after-free (CWE-416) in the Core component of Google Chrome, patched in Chrome 153.0.8010.36. A remote attacker triggers it by using social engineering to convince a victim to install or interact with a crafted Chrome extension, causing memory corruption in the browser's Core component. Successful exploitation yields arbitrary code execution outside Chrome's security sandbox, meaning the attacker gains control at the operating-system level rather than being confined to a renderer process. Everyone running Chrome before 153.0.8010.36 is affected, which in practice means nearly the entire Chrome install base. Chrome 153 shipped 230 vulnerability fixes, and related reporting indicates one of those fixes was a 0-day exploited in the wild; this issue has no known public proof-of-concept, is not in CISA KEV, carries a low 0.2% EPSS score, and was rated Medium by Chromium because exploitation requires user interaction.
· Google Chrome all versions prior to 153.0.8010.36 (fixed in 153.0.8010.36)mass
Out-of-Bounds Write in Google Chrome for Android WebGL Enables Sandbox-Escape RCE
CVE-2026-87438 is an out-of-bounds write (CWE-787) in the WebGL component of Google Chrome running on Android. A remote attacker can trigger the flaw by persuading a user to open a crafted HTML page, requiring no privileges and only user interaction. Successful exploitation yields arbitrary code execution outside the browser sandbox, meaning the attacker escapes Chrome's renderer sandbox and compromises the device at a level beyond the web content, with high confidentiality, integrity and availability impact. Users of Chrome on Android prior to 153.0.8010.36 are affected; the fix ships in Chrome 153, a release that includes roughly 230 security fixes. Exploitation of this specific WebGL flaw has not been documented so far (not in CISA KEV, EPSS ~0.4%, no public PoC); the actively exploited zero-day referenced in recent headlines is a separate V8 bug that was patched in the same Chrome 153 release.
· Google Chrome (on Android) All versions prior to 153.0.8010.36; fixed in 153.0.8010.36mass
Use-After-Free in WebGL in Google Chrome for Android Allows RCE Outside Sandbox
CVE-2026-87488 is a use-after-free (CWE-416) in the WebGL component of Google Chrome on Android, fixed in Chrome 153.0.8010.36. A remote attacker triggers it by luring a user to open a crafted HTML page in a vulnerable Chrome for Android build. Successful exploitation allows the attacker to execute arbitrary code outside the browser's sandbox, meaning code runs beyond the browser's security boundary on the device. All Chrome for Android users running versions prior to 153.0.8010.36 are affected. No public proof-of-concept is known and the flaw is not in CISA's KEV, with EPSS assigning a 0.4% 30-day exploitation probability; note that the same Chrome 153 release fixes 230 issues, including a separate, actively exploited V8 zero-day (code execution inside the sandbox) that should not be confused with this WebGL bug.
· Google Chrome for Android All versions prior to 153.0.8010.36mass
Double-Free in Google Chrome PDFium (Windows) Enables Sandbox-Confined Code Execution
CVE-2026-87585 is a double-free memory-corruption flaw (CWE-415) in the PDFium PDF rendering engine of Google Chrome on Windows. It is triggered when the browser opens a maliciously crafted PDF file, and a successful exploit allows a remote attacker to potentially execute arbitrary code inside Chrome's sandbox, limiting but not eliminating attacker access per the High CVSS impact ratings. All Chrome users on Windows running versions prior to 153.0.8010.36 are affected. No public proof-of-concept is known, the bug is not in CISA's KEV, and EPSS estimates only a ~0.2% probability of exploitation within 30 days. The fix is included in Chrome 153.0.8010.36 for Windows, a release with 230 security fixes that also addresses a separately reported zero-day exploited in the wild, though the headlines do not confirm whether that zero-day is this specific flaw.
· Google Chrome (PDFium) on Windows All versions prior to 153.0.8010.36 on Windowsmass
Use-After-Free in Google Chrome Cast Allows Sandbox-Escaping Code Execution
CVE-2026-87628 is a use-after-free (CWE-416) in the Cast component of Google Chrome, rated Critical by Chromium, that is triggered when the browser processes crafted network traffic sent by an attacker on an adjacent network (e.g., the same LAN segment). A successful attack can allow the adjacent attacker to execute arbitrary code outside the Chrome sandbox, a stronger outcome than typical renderer-only bugs because it escapes Chrome's containment model. All Google Chrome versions prior to 153.0.8010.36 are affected; the flaw is fixed in Chrome 153.0.8010.36, part of the Chrome 153 release that ships 230 security fixes. No public proof-of-concept is known, the bug is not in CISA KEV, and EPSS estimates only a 0.2% chance of exploitation within 30 days, so there is no known exploitation of this specific Cast bug. Note that the actively exploited zero-day in the Chrome 153 headlines is a separate V8 flaw that allows code execution only inside the sandbox, and should not be confused with this outside-the-sandbox Cast issue.
· Google Chrome All versions prior to 153.0.8010.36 (fixed in 153.0.8010.36)mass
Out-of-Bounds Read in Chrome for Android WebView Enables Sandbox Memory Disclosure
CVE-2026-87640 is an out-of-bounds read (CWE-125) in the WebView component of Google Chrome on Android, fixed in Chrome 153.0.8010.36. It is triggered when the browser renders a crafted HTML page, allowing an attacker who has already compromised the renderer process to read memory outside the sandbox. Successful exploitation results in information disclosure from memory outside the WebView sandbox; as a Medium-severity read bug, it does not by itself provide code execution or privilege escalation. Only Chrome on Android builds prior to 153.0.8010.36 are named in the advisory; other platforms are not listed as affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known for this specific flaw (EPSS 0.2%), though the same Chrome 153 release also patched a separate 0-day that is being exploited.
· Google Chrome for Android (WebView component) all versions prior to 153.0.8010.36mass
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.