Google shipped Chrome 153.0.8010.36/.37 fixing 230 flaws including actively exploited V8 out-of-bounds write CVE-2026-87491 enabling sandboxed code execution.
Chrome stable channel updated to 153.0.8010.36/.37 for Windows and Mac and 153.0.8010.36 for Linux, including 230 security fixes. CVE-2026-87491 is an out-of-bounds write in Chrome's V8 JavaScript engine that a crafted HTML page can exploit to execute arbitrary code inside the browser sandbox; Google rates it medium severity, but it is confirmed as actively exploited. The update also fixes five Critical vulnerabilities, four of which were found in WebGL. Users should update via Settings > About Chrome and restart the browser.
Google patched actively exploited Chrome V8 out-of-bounds write CVE-2026-87491; CISA added it to KEV with a September 23 patch deadline.
Google fixed 230 Chrome vulnerabilities in its stable channel update, including CVE-2026-87491, an out-of-bounds write in the V8 JavaScript engine being exploited in the wild. The flaw, reported by Jihyeon Jeong of Compsec Lab, Seoul National University, is the seventh Chrome zero-day patched by Google in 2026. It affects Chrome versions before 153.0.8010.36, and CISA added it to the Known Exploited Vulnerabilities Catalog urging patching before September 23, 2026. Users should upgrade to Chrome 153.0.8010.36 (Linux) or 153.0.8010.36/.37 (Windows/Mac); Qualys customers can detect vulnerable assets with QID 388666.
Google patched 230 Chrome flaws in version 153.0.8010.36, including actively exploited V8 out-of-bounds write CVE-2026-87491 (CVSS 8.8), the seventh 2026 Chrome zero-day.
Google released Chrome 153.0.8010.36 on Linux and 153.0.8010.36/.37 on Windows and Mac, fixing 230 security vulnerabilities. CVE-2026-87491, an out-of-bounds write in the V8 JavaScript and WebAssembly engine (CVSS 8.8), is being exploited in the wild through specially crafted HTML pages to execute arbitrary code inside Chrome's sandbox. Google says it is the seventh actively exploited Chrome zero-day of 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, and CVE-2026-85046. Researcher Jihyeon Jeong of Seoul National University reported it on 2026-08-06 and received a $2,500 bounty; Google disclosed no technical details or attribution.
Cloudflare rewrote the Workers (workerd) module registry for Node.js-compatible URL-based module resolution, shipped behind the new_module_registry flag with a 64 MiB bundle limit.
Cloudflare rebuilt the module registry in workerd, the open-source Workers runtime, so module specifiers are resolved as URLs and ESM, CommonJS, and WebAssembly modules follow Node.js semantics. The change is enabled with the new_module_registry compatibility flag and adds import.meta.resolve(), require(esm), import attributes validation, lazy compilation, and cross-isolate cache sharing. It also lifts the compressed bundle size limit to 64 MiB on all plans; the legacy registry implementation remains available.
Google patches Chrome V8 zero-day CVE-2026-87491, exploited in the wild, marking the seventh exploited Chrome zero-day of 2026, in an update fixing 230 flaws.
Google released Chrome 153 with fixes for 230 vulnerabilities, including CVE-2026-87491, a medium-severity out-of-bounds write in the V8 JavaScript and WebAssembly engine that Google says is being exploited in the wild. It is the seventh zero-day patched in Chrome in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645 and CVE-2026-85046. The update also fixes five critical bugs (four in WebGL, one in Cast), 41 high-severity defects, and more than 180 medium/low issues, rolling out as 153.0.8010.36/.37 for Windows/macOS and 153.0.8010.36 for Linux.
Google patches actively exploited Chrome V8 zero-day CVE-2026-87491, an out-of-bounds write enabling sandboxed code execution via crafted HTML pages.
Google released Chrome 153.0.8010.36/.37 fixing 230 vulnerabilities, including CVE-2026-87491, an out-of-bounds write in the V8 engine that allowed remote code execution inside the sandbox via a crafted HTML page and is confirmed to be exploited in the wild. The flaw was reported on August 6, 2026 by Jihyeon Jeong of Compsec Lab, Seoul National University, who received a $2,500 bug bounty. This is the seventh actively exploited Chrome zero-day of 2026. The update also fixes five critical flaws in WebGL and Cast, plus a high WebPackaging use-after-free (CVE-2026-87639) credited to OpenAI Codex Security.
Google patched actively exploited Chrome zero-day CVE-2026-87491, a V8 out-of-bounds write enabling sandboxed code execution, in Chrome 153.0.8010.36+.
Google fixed 230 Chrome vulnerabilities including CVE-2026-87491, a Medium-severity out-of-bounds write in the V8 JavaScript and WebAssembly engine that allows remote arbitrary code execution inside the sandbox via a crafted HTML page. Google confirmed an exploit exists in the wild; fixes shipped in Chrome 153.0.8010.36 and .37 for Windows and macOS and 153.0.8010.36 for Linux. The flaw was reported August 6, 2026 by Jihyeon Jeong of Seoul National University's Compsec Lab, earning a $2,500 bounty. It is the seventh actively exploited Chrome zero-day patched in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645 and CVE-2026-85046.
Google released Chrome 153 with 230 security fixes, patching CVE-2026-87491, a V8 out-of-bounds write zero-day actively exploited in the wild.
Google shipped Chrome 153 (153.0.8010.36/.37) for Windows, macOS, and Linux with 230 security fixes, including CVE-2026-87491, a medium-severity V8 out-of-bounds write being exploited in the wild. The release also fixes five critical vulnerabilities: four in WebGL (two use-after-frees, an out-of-bounds write, a buffer overflow) and one use-after-free in Cast. High-severity V8 use-after-free and type-confusion defects are among the fixes, and Google has restricted technical details until most users are patched. Administrators should verify deployed versions on managed endpoints, as Chrome-derived browsers may follow different patch schedules.
Google shipped Chrome 153 with 230 fixes, including CVE-2026-87491, a V8 out-of-bounds write zero-day exploited in the wild.
Chrome 153 (153.0.8010.36/.37) rolls out to Windows, Mac, and Linux with 230 security fixes, among the largest patch batches in recent Chrome history. The headline flaw is CVE-2026-87491, a Medium-severity out-of-bounds write in the V8 JavaScript and WebAssembly engine that Google confirmed is exploited in the wild; it was reported by Jihyeon Jeong of Compsec Lab at Seoul National University for a $2,500 bounty. The release also closes five Critical-rated flaws, including CVE-2026-87464, CVE-2026-87488, CVE-2026-87438, CVE-2026-87527, and CVE-2026-87628, mostly use-after-free and out-of-bounds write bugs in WebGL and Cast, plus 43 High-severity issues across ANGLE, PDFium, V8, DevTools, and Payments. Several bugs were surfaced with AI-assisted discovery tools, including OpenAI's Codex Security team, and top bounties reached $5,000 for CVE-2026-87504.
Google patches actively exploited Chrome zero-day CVE-2026-85046, a V8 type confusion bug enabling sandboxed code execution via crafted HTML pages.
Google patched 12 Chrome vulnerabilities, including CVE-2026-85046, a CVSS 8.8 type confusion flaw in the V8 JavaScript and WebAssembly engine exploited in the wild. The bug, reported by researcher Salvatore Gulizia (Serotav) on August 4, 2026, allows arbitrary code execution inside the sandbox via a crafted HTML page; the researcher described it as a V8 compiler bug enabling arbitrary read/write on the JavaScript heap. Fixes shipped in Chrome 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux, and this is the sixth Chrome zero-day Google has fixed in 2026.
CISA added actively exploited Chrome V8 type-confusion flaw CVE-2026-85046 (CVSS 8.8) to its KEV catalog; Google patched it in Chrome 152.
CISA added CVE-2026-85046 (CVSS 8.8), a V8 type confusion flaw, to its Known Exploited Vulnerabilities catalog, requiring US federal agencies to patch by September 18, 2026. Google fixed it in Chrome Stable 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, alongside 11 other vulnerabilities. The bug lets a remote attacker execute arbitrary code inside the browser sandbox via a crafted HTML page and is the sixth actively exploited Chrome zero-day of 2026. Researcher Salvatore Gulizia (Serotav) reported it on August 4, 2026.
CISA added CVE-2026-85046, a Google Chromium V8 type confusion vulnerability with evidence of active exploitation, to its KEV Catalog.
On September 4, 2026, CISA added one vulnerability to the Known Exploited Vulnerabilities Catalog: CVE-2026-85046, a type confusion flaw in Google Chromium's V8 engine, added based on evidence of active exploitation. CISA notes type confusion is a frequent attack vector and poses significant risk to the federal enterprise. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies must prioritize remediation of KEV vulnerabilities on exposed assets and check for pre-patch compromise; all organizations are urged to prioritize the patch.
CISA added actively exploited Chromium V8 type confusion CVE-2026-85046 to the KEV catalog, requiring federal mitigation by September 18.
CISA added CVE-2026-85046, a type confusion vulnerability in Google Chromium's V8 JavaScript engine, to the Known Exploited Vulnerabilities catalog. The flaw allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page and affects Chromium-based browsers including Google Chrome, Microsoft Edge, and Opera. Federal agencies must apply vendor mitigations by 2026-09-18 under BOD 26-04; CISA notes known ransomware campaign use is currently unknown.
Google patched 26 Chrome flaws, including two critical use-after-frees and an actively exploited V8 sandbox escape (CVE-2026-85046); update to 152.0.7977.82/.83.
Chrome's desktop update fixes 26 security issues, including critical use-after-free flaws CVE-2026-84353 in Shared Tab Groups and CVE-2026-84352 in WebGL, both allowing code execution outside the browser sandbox via crafted HTML pages. Google subsequently patched CVE-2026-85046, a high-severity V8 JavaScript engine flaw with exploits already in the wild that enables arbitrary code execution inside the Chrome sandbox; HKCERT rates the overall risk as extremely high. Fixed versions are 152.0.7977.82/.83 on Windows and Mac and 152.0.7977.82 on Linux.
Check Point's hasherezade details static deobfuscation of JSCeal, a V8-bytecode stealer targeting cryptocurrency applications since March 2024.
JSCeal is an infostealer distributed as compiled V8 bytecode (.jsc) executed by a bundled Node.js runtime, aimed at cryptocurrency applications. Other vendors track the same family under the names WEEVILPROXY or MeadowLocust. Check Point Research has tracked the campaign since early 2024, with activity dating back to March 2024. The write-up presents a static approach to unpacking the bytecode without executing it.
Critical type-confusion flaw in isolated-vm Node.js sandbox (GHSA-864f-rcv7-6rh4) enables guest-to-host escape and potential RCE; fixed in 6.2.0 and 7.0.1.
Endor Labs researcher Cristian-Alexandru Staicu found a type confusion in the ExternalCopy component's handling of the transferList option in isolated-vm, letting sandboxed JavaScript corrupt host-process memory and escalate from controlled-address crashes to full control-flow hijack of the host, i.e., potential remote code execution. The flaw, tracked as GHSA-864f-rcv7-6rh4 with no CVE yet, affects all versions through 7.0.0 of the library, which sees nearly 1 million npm downloads weekly. It was patched in versions 6.2.0 and 7.0.1 released earlier in August 2026, and full exploit details are withheld to prevent attacks. The V8 Isolate boundary itself held; the failure was in the C++ marshalling code bridging host and guest.
Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
Google Chrome versions prior to 152.0.7977.82 contain a type confusion flaw (CWE-843) in the V8 JavaScript engine, which mishandles object types during engine operations (public proof-of-concept writeups indicate it is reachable through array sorting and WebAssembly-related code paths). A remote attacker triggers the flaw simply by getting a user to open a crafted HTML page, with no privileges or authentication required. Successful exploitation lets the attacker execute arbitrary code inside the browser's sandbox, and public reporting shows it being chained with Windows zero-days (the 'BlueMoon' exploit kit) by Chinese espionage groups for broader compromise. Any user of an unpatched Chrome or another build embedding the affected V8 engine is exposed. The vulnerability is a zero-day that was actively exploited in the wild before patching, was added to CISA's KEV on 2026-09-04, and has five public proof-of-concept references.
· Google Chrome prior to 152.0.7977.82 · Google Chromium V8 V8 engine versions bundled with Chrome prior to 152.0.7977.82 KEV PoC ×5mass
Actively Exploited Out-of-Bounds Write in Google Chrome V8
CVE-2026-87491 is an out-of-bounds write (CWE-787) in the V8 JavaScript engine in Google Chrome, fixed in Chrome 153.0.8010.36, which Google shipped alongside roughly 230 other security fixes. An attacker can trigger the flaw remotely by luring a user (user interaction required) into opening a crafted HTML page that corrupts memory in V8. Successful exploitation allows the attacker to execute arbitrary code inside the Chrome browser sandbox, which constrains but does not eliminate the impact. All Google Chrome users running versions prior to 153.0.8010.36 are affected; because the flaw resides in V8, CISA tracks it as 'Google Chromium V8', and other Chromium-based browsers may inherit the fix in their own updates. The flaw is being actively exploited in the wild — it is the seventh actively exploited Chrome zero-day of 2026 and was added to CISA's KEV catalog on 2026-09-09 — though no public proof-of-concept is known and ransomware use is unknown.
· Google Chrome (V8 JavaScript engine; tracked by CISA as 'Google Chromium V8') prior to 153.0.8010.36 KEVmass
Out-of-Bounds Write in Google Chrome's Skia Rendering Engine
CVE-2026-3909 is an out-of-bounds write (CWE-787) in the Skia graphics rendering library used by Google Chrome, which Google patched in Chrome 146.0.7680.75. A remote attacker can trigger the flaw by luring a user to visit a crafted HTML page, causing out-of-bounds memory access in the browser process; the High CVSS 8.8 score with high confidentiality, integrity, and availability impact indicates memory corruption with potentially serious consequences. All Google Chrome installations running versions prior to 146.0.7680.75 are affected, and because the vulnerability resides in the Skia engine, the vulnerable code is present in every Chrome install. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-03-13, indicating exploitation in the wild, though no public proof-of-concept is known and ransomware use is unknown. EPSS currently assigns a 1.6% probability of exploitation within the next 30 days (75th percentile).
· Google Chrome (Skia rendering engine) all versions prior to 146.0.7680.75 · Google Skia (as shipped in Google Chrome, per CISA) prior to Chrome 146.0.7680.75 KEVmass
Out-of-Bounds Memory Flaw in Google Chrome V8 Allows Sandboxed Code Execution
CVE-2026-3910 is an out-of-bounds memory flaw — CISA classifies it as improper restriction of operations within the bounds of a memory buffer — caused by an inappropriate implementation in the V8 JavaScript and WebAssembly engine used in Google Chrome. A remote attacker triggers it by luring a user to a crafted HTML page, so exploitation requires user interaction but no privileges or special conditions. Successful exploitation allows the attacker to execute arbitrary code inside the Chrome sandbox, which confines the compromise to the renderer process rather than the full system, but still exposes data and credentials handled within the browser session. Anyone running Google Chrome prior to 146.0.7680.75 — or a Chromium-based browser that embeds the vulnerable V8 code — is affected. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-03-13, and it comes amid a string of actively exploited Chrome V8 zero-days that Google has fixed during 2026.
· google chrome prior to 146.0.7680.75 (fixed in 146.0.7680.75) KEVmass
Use-After-Free in Google Chrome's Dawn (WebGPU) Component Enables Arbitrary Code Execution
CVE-2026-5281 is a use-after-free vulnerability in Dawn, the WebGPU implementation in Google Chrome, that Google patched in Chrome 146.0.7680.178. It is triggered when a remote attacker serves a crafted HTML page and can leverage it after having already compromised the Chrome renderer process, escalating to arbitrary code execution beyond the initial foothold. Because the flaw requires a compromised renderer as a starting point, it is typically chained with another bug (such as a renderer-exploiting issue) to break out to arbitrary code execution with real impact on confidentiality, integrity, and availability. Any user or organization running Google Chrome on a version prior to 146.0.7680.178 is affected. The flaw is confirmed as exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-04-01, and its EPSS score of 4.9% (92nd percentile) indicates a meaningful near-term exploitation probability.
· Google Chrome prior to 146.0.7680.178 · Google Dawn (WebGPU implementation bundled in Chrome) as shipped in Chrome prior to 146.0.7680.178 KEVmass
Out-of-Bounds Read/Write in Google Chrome V8 Enables In-Sandbox Code Execution
CVE-2026-11645 is an out-of-bounds read and write (CWE-125/CWE-787) in V8, the JavaScript engine used by Google Chrome and Chromium. A remote attacker triggers the flaw by luring a user to a crafted HTML page, where malicious script causes V8 to read and write outside allocated memory buffers. Successful exploitation allows the attacker to execute arbitrary code inside the browser's security sandbox, providing limited privileges within that process rather than full system compromise. All Google Chrome versions prior to 149.0.7827.103 are affected, along with the Chromium V8 component identified by CISA. The flaw is being exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-09, and related headlines describe an actively exploited Chrome V8 zero-day, though no public proof-of-concept is known and ransomware use is unconfirmed.
· Google Chrome prior to 149.0.7827.103 · Google Chromium V8 (as shipped in Chrome) prior to the 149.0.7827.103 Chrome release KEVmass
Use-After-Free in Google Chromium CSS Rendering Exposes Chrome, Edge, Opera Users
CVE-2026-2441 is a use-after-free (CWE-416) in Google Chromium's CSS handling that a remote attacker can trigger by getting a user's browser to process a crafted HTML page, potentially corrupting the heap. Successful exploitation yields a memory-corruption primitive in the browser; CVSS scoring is not yet available, but Chromium memory-safety flaws of this class can range from crashes to potential code execution depending on how the corruption is leveraged. Anyone running Chromium or a Chromium-based browser — Google Chrome, Microsoft Edge, Opera, and numerous embedded/branded browsers — is potentially affected, making the exposed population effectively all modern browser users. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-02-17, confirming it is being exploited in the wild; EPSS assigns a 22% probability of exploitation within 30 days (98th percentile), no public PoC is known, and any ransomware association is unknown. This lands amid an accelerating series of actively exploited Chrome zero-days in 2026 described in recent reporting, making rapid patching urgent.
· Google Chromium · Google Chrome (Chromium-based) KEV PoC mass
Heap Buffer Overflow in Google Chrome WebGL Enables RCE Outside the Sandbox
CVE-2026-87527 is a buffer overflow (CWE-122) in the WebGL component of Google Chrome that is triggered when a user visits a crafted HTML page, requiring no authentication and no special privileges. Successful exploitation allows a remote attacker to execute arbitrary code outside the browser sandbox, meaning the attacker breaks out of Chrome's core containment boundary — a high-impact outcome reflected in its Critical Chromium severity and 9.6 CVSS score. All users running Google Chrome versions prior to 153.0.8010.36 are affected. As of this analysis there is no public proof of concept, the flaw is not in CISA's KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days; the zero-day exploited in the wild cited in related headlines is a separate V8 issue also fixed in the Chrome 153 release. Defenders should nonetheless treat this as high priority given the severity, the attack's web-browsing trigger, and the sandbox-escape impact.
· Google Chrome All versions prior to 153.0.8010.36mass
Use-After-Free in WebGL in Google Chrome Allows Code Execution Outside the Sandbox
CVE-2026-87464 is a use-after-free (CWE-416) in the WebGL component of Google Chrome affecting versions prior to 153.0.8010.36. A remote attacker can trigger it by luring a user to open a crafted HTML page, which corrupts memory in the browser's WebGL rendering path. Successful exploitation allows arbitrary code execution outside the browser sandbox, meaning the attacker escapes Chrome's process isolation and runs code with the privileges of the browser on the host. All Chrome users running an unpatched version before 153.0.8010.36 are affected. As of now there is no public proof-of-concept and this specific flaw is not in CISA KEV, although the Chrome 153 release headlines reference a separate V8 zero-day that was exploited in the wild.
· google chrome all versions prior to 153.0.8010.36mass
Use-After-Free in Google Chrome Cast Allows Sandbox-Escaping Code Execution
CVE-2026-87628 is a use-after-free (CWE-416) in the Cast component of Google Chrome, rated Critical by Chromium, that is triggered when the browser processes crafted network traffic sent by an attacker on an adjacent network (e.g., the same LAN segment). A successful attack can allow the adjacent attacker to execute arbitrary code outside the Chrome sandbox, a stronger outcome than typical renderer-only bugs because it escapes Chrome's containment model. All Google Chrome versions prior to 153.0.8010.36 are affected; the flaw is fixed in Chrome 153.0.8010.36, part of the Chrome 153 release that ships 230 security fixes. No public proof-of-concept is known, the bug is not in CISA KEV, and EPSS estimates only a 0.2% chance of exploitation within 30 days, so there is no known exploitation of this specific Cast bug. Note that the actively exploited zero-day in the Chrome 153 headlines is a separate V8 flaw that allows code execution only inside the sandbox, and should not be confused with this outside-the-sandbox Cast issue.
· Google Chrome All versions prior to 153.0.8010.36 (fixed in 153.0.8010.36)mass
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.