Google shipped Chrome 153.0.8010.36/.37 fixing 230 flaws including actively exploited V8 out-of-bounds write CVE-2026-87491 enabling sandboxed code execution.
Chrome stable channel updated to 153.0.8010.36/.37 for Windows and Mac and 153.0.8010.36 for Linux, including 230 security fixes. CVE-2026-87491 is an out-of-bounds write in Chrome's V8 JavaScript engine that a crafted HTML page can exploit to execute arbitrary code inside the browser sandbox; Google rates it medium severity, but it is confirmed as actively exploited. The update also fixes five Critical vulnerabilities, four of which were found in WebGL. Users should update via Settings > About Chrome and restart the browser.
Google patches Chrome V8 zero-day CVE-2026-87491, exploited in the wild, marking the seventh exploited Chrome zero-day of 2026, in an update fixing 230 flaws.
Google released Chrome 153 with fixes for 230 vulnerabilities, including CVE-2026-87491, a medium-severity out-of-bounds write in the V8 JavaScript and WebAssembly engine that Google says is being exploited in the wild. It is the seventh zero-day patched in Chrome in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645 and CVE-2026-85046. The update also fixes five critical bugs (four in WebGL, one in Cast), 41 high-severity defects, and more than 180 medium/low issues, rolling out as 153.0.8010.36/.37 for Windows/macOS and 153.0.8010.36 for Linux.
Google patches actively exploited Chrome V8 zero-day CVE-2026-87491, an out-of-bounds write enabling sandboxed code execution via crafted HTML pages.
Google released Chrome 153.0.8010.36/.37 fixing 230 vulnerabilities, including CVE-2026-87491, an out-of-bounds write in the V8 engine that allowed remote code execution inside the sandbox via a crafted HTML page and is confirmed to be exploited in the wild. The flaw was reported on August 6, 2026 by Jihyeon Jeong of Compsec Lab, Seoul National University, who received a $2,500 bug bounty. This is the seventh actively exploited Chrome zero-day of 2026. The update also fixes five critical flaws in WebGL and Cast, plus a high WebPackaging use-after-free (CVE-2026-87639) credited to OpenAI Codex Security.
Google shipped Chrome 153 with 230 fixes, including CVE-2026-87491, a V8 out-of-bounds write zero-day exploited in the wild.
Chrome 153 (153.0.8010.36/.37) rolls out to Windows, Mac, and Linux with 230 security fixes, among the largest patch batches in recent Chrome history. The headline flaw is CVE-2026-87491, a Medium-severity out-of-bounds write in the V8 JavaScript and WebAssembly engine that Google confirmed is exploited in the wild; it was reported by Jihyeon Jeong of Compsec Lab at Seoul National University for a $2,500 bounty. The release also closes five Critical-rated flaws, including CVE-2026-87464, CVE-2026-87488, CVE-2026-87438, CVE-2026-87527, and CVE-2026-87628, mostly use-after-free and out-of-bounds write bugs in WebGL and Cast, plus 43 High-severity issues across ANGLE, PDFium, V8, DevTools, and Payments. Several bugs were surfaced with AI-assisted discovery tools, including OpenAI's Codex Security team, and top bounties reached $5,000 for CVE-2026-87504.
Actively Exploited Out-of-Bounds Write in Google Chrome V8
CVE-2026-87491 is an out-of-bounds write (CWE-787) in the V8 JavaScript engine in Google Chrome, fixed in Chrome 153.0.8010.36, which Google shipped alongside roughly 230 other security fixes. An attacker can trigger the flaw remotely by luring a user (user interaction required) into opening a crafted HTML page that corrupts memory in V8. Successful exploitation allows the attacker to execute arbitrary code inside the Chrome browser sandbox, which constrains but does not eliminate the impact. All Google Chrome users running versions prior to 153.0.8010.36 are affected; because the flaw resides in V8, CISA tracks it as 'Google Chromium V8', and other Chromium-based browsers may inherit the fix in their own updates. The flaw is being actively exploited in the wild — it is the seventh actively exploited Chrome zero-day of 2026 and was added to CISA's KEV catalog on 2026-09-09 — though no public proof-of-concept is known and ransomware use is unknown.
· Google Chrome (V8 JavaScript engine; tracked by CISA as 'Google Chromium V8') prior to 153.0.8010.36 KEVmass
Out-of-Bounds Memory Flaw in Google Chrome V8 Allows Sandboxed Code Execution
CVE-2026-3910 is an out-of-bounds memory flaw — CISA classifies it as improper restriction of operations within the bounds of a memory buffer — caused by an inappropriate implementation in the V8 JavaScript and WebAssembly engine used in Google Chrome. A remote attacker triggers it by luring a user to a crafted HTML page, so exploitation requires user interaction but no privileges or special conditions. Successful exploitation allows the attacker to execute arbitrary code inside the Chrome sandbox, which confines the compromise to the renderer process rather than the full system, but still exposes data and credentials handled within the browser session. Anyone running Google Chrome prior to 146.0.7680.75 — or a Chromium-based browser that embeds the vulnerable V8 code — is affected. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-03-13, and it comes amid a string of actively exploited Chrome V8 zero-days that Google has fixed during 2026.
· google chrome prior to 146.0.7680.75 (fixed in 146.0.7680.75) KEVmass
Out-of-Bounds Read/Write in Google Chrome V8 Enables In-Sandbox Code Execution
CVE-2026-11645 is an out-of-bounds read and write (CWE-125/CWE-787) in V8, the JavaScript engine used by Google Chrome and Chromium. A remote attacker triggers the flaw by luring a user to a crafted HTML page, where malicious script causes V8 to read and write outside allocated memory buffers. Successful exploitation allows the attacker to execute arbitrary code inside the browser's security sandbox, providing limited privileges within that process rather than full system compromise. All Google Chrome versions prior to 149.0.7827.103 are affected, along with the Chromium V8 component identified by CISA. The flaw is being exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-09, and related headlines describe an actively exploited Chrome V8 zero-day, though no public proof-of-concept is known and ransomware use is unconfirmed.
· Google Chrome prior to 149.0.7827.103 · Google Chromium V8 (as shipped in Chrome) prior to the 149.0.7827.103 Chrome release KEVmass
Use-After-Free in Google Chrome's Dawn (WebGPU) Component Enables Arbitrary Code Execution
CVE-2026-5281 is a use-after-free vulnerability in Dawn, the WebGPU implementation in Google Chrome, that Google patched in Chrome 146.0.7680.178. It is triggered when a remote attacker serves a crafted HTML page and can leverage it after having already compromised the Chrome renderer process, escalating to arbitrary code execution beyond the initial foothold. Because the flaw requires a compromised renderer as a starting point, it is typically chained with another bug (such as a renderer-exploiting issue) to break out to arbitrary code execution with real impact on confidentiality, integrity, and availability. Any user or organization running Google Chrome on a version prior to 146.0.7680.178 is affected. The flaw is confirmed as exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-04-01, and its EPSS score of 4.9% (92nd percentile) indicates a meaningful near-term exploitation probability.
· Google Chrome prior to 146.0.7680.178 · Google Dawn (WebGPU implementation bundled in Chrome) as shipped in Chrome prior to 146.0.7680.178 KEVmass
Out-of-Bounds Write in Google Chrome's Skia Rendering Engine
CVE-2026-3909 is an out-of-bounds write (CWE-787) in the Skia graphics rendering library used by Google Chrome, which Google patched in Chrome 146.0.7680.75. A remote attacker can trigger the flaw by luring a user to visit a crafted HTML page, causing out-of-bounds memory access in the browser process; the High CVSS 8.8 score with high confidentiality, integrity, and availability impact indicates memory corruption with potentially serious consequences. All Google Chrome installations running versions prior to 146.0.7680.75 are affected, and because the vulnerability resides in the Skia engine, the vulnerable code is present in every Chrome install. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-03-13, indicating exploitation in the wild, though no public proof-of-concept is known and ransomware use is unknown. EPSS currently assigns a 1.6% probability of exploitation within the next 30 days (75th percentile).
· Google Chrome (Skia rendering engine) all versions prior to 146.0.7680.75 · Google Skia (as shipped in Google Chrome, per CISA) prior to Chrome 146.0.7680.75 KEVmass
Use-After-Free in Google Chromium CSS Rendering Exposes Chrome, Edge, Opera Users
CVE-2026-2441 is a use-after-free (CWE-416) in Google Chromium's CSS handling that a remote attacker can trigger by getting a user's browser to process a crafted HTML page, potentially corrupting the heap. Successful exploitation yields a memory-corruption primitive in the browser; CVSS scoring is not yet available, but Chromium memory-safety flaws of this class can range from crashes to potential code execution depending on how the corruption is leveraged. Anyone running Chromium or a Chromium-based browser — Google Chrome, Microsoft Edge, Opera, and numerous embedded/branded browsers — is potentially affected, making the exposed population effectively all modern browser users. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-02-17, confirming it is being exploited in the wild; EPSS assigns a 22% probability of exploitation within 30 days (98th percentile), no public PoC is known, and any ransomware association is unknown. This lands amid an accelerating series of actively exploited Chrome zero-days in 2026 described in recent reporting, making rapid patching urgent.
· Google Chromium · Google Chrome (Chromium-based) KEV PoC mass
Heap Buffer Overflow in Google Chrome WebGL Enables RCE Outside the Sandbox
CVE-2026-87527 is a buffer overflow (CWE-122) in the WebGL component of Google Chrome that is triggered when a user visits a crafted HTML page, requiring no authentication and no special privileges. Successful exploitation allows a remote attacker to execute arbitrary code outside the browser sandbox, meaning the attacker breaks out of Chrome's core containment boundary — a high-impact outcome reflected in its Critical Chromium severity and 9.6 CVSS score. All users running Google Chrome versions prior to 153.0.8010.36 are affected. As of this analysis there is no public proof of concept, the flaw is not in CISA's KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days; the zero-day exploited in the wild cited in related headlines is a separate V8 issue also fixed in the Chrome 153 release. Defenders should nonetheless treat this as high priority given the severity, the attack's web-browsing trigger, and the sandbox-escape impact.
· Google Chrome All versions prior to 153.0.8010.36mass
Use-After-Free in WebGL in Google Chrome Allows Code Execution Outside the Sandbox
CVE-2026-87464 is a use-after-free (CWE-416) in the WebGL component of Google Chrome affecting versions prior to 153.0.8010.36. A remote attacker can trigger it by luring a user to open a crafted HTML page, which corrupts memory in the browser's WebGL rendering path. Successful exploitation allows arbitrary code execution outside the browser sandbox, meaning the attacker escapes Chrome's process isolation and runs code with the privileges of the browser on the host. All Chrome users running an unpatched version before 153.0.8010.36 are affected. As of now there is no public proof-of-concept and this specific flaw is not in CISA KEV, although the Chrome 153 release headlines reference a separate V8 zero-day that was exploited in the wild.
· google chrome all versions prior to 153.0.8010.36mass
Out-of-Bounds Write in Google Chrome for Android WebGL Enables Sandbox-Escape RCE
CVE-2026-87438 is an out-of-bounds write (CWE-787) in the WebGL component of Google Chrome running on Android. A remote attacker can trigger the flaw by persuading a user to open a crafted HTML page, requiring no privileges and only user interaction. Successful exploitation yields arbitrary code execution outside the browser sandbox, meaning the attacker escapes Chrome's renderer sandbox and compromises the device at a level beyond the web content, with high confidentiality, integrity and availability impact. Users of Chrome on Android prior to 153.0.8010.36 are affected; the fix ships in Chrome 153, a release that includes roughly 230 security fixes. Exploitation of this specific WebGL flaw has not been documented so far (not in CISA KEV, EPSS ~0.4%, no public PoC); the actively exploited zero-day referenced in recent headlines is a separate V8 bug that was patched in the same Chrome 153 release.
· Google Chrome (on Android) All versions prior to 153.0.8010.36; fixed in 153.0.8010.36mass
Use-After-Free in Google Chrome Cast Allows Sandbox-Escaping Code Execution
CVE-2026-87628 is a use-after-free (CWE-416) in the Cast component of Google Chrome, rated Critical by Chromium, that is triggered when the browser processes crafted network traffic sent by an attacker on an adjacent network (e.g., the same LAN segment). A successful attack can allow the adjacent attacker to execute arbitrary code outside the Chrome sandbox, a stronger outcome than typical renderer-only bugs because it escapes Chrome's containment model. All Google Chrome versions prior to 153.0.8010.36 are affected; the flaw is fixed in Chrome 153.0.8010.36, part of the Chrome 153 release that ships 230 security fixes. No public proof-of-concept is known, the bug is not in CISA KEV, and EPSS estimates only a 0.2% chance of exploitation within 30 days, so there is no known exploitation of this specific Cast bug. Note that the actively exploited zero-day in the Chrome 153 headlines is a separate V8 flaw that allows code execution only inside the sandbox, and should not be confused with this outside-the-sandbox Cast issue.
· Google Chrome All versions prior to 153.0.8010.36 (fixed in 153.0.8010.36)mass
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.