Chrome 153 Fixes 230 Vulnerabilities, Including One 0-Day Exploited in the Wild
Google shipped Chrome 153 with 230 fixes, including CVE-2026-87491, a V8 out-of-bounds write zero-day exploited in the wild.
Chrome 153 (153.0.8010.36/.37) rolls out to Windows, Mac, and Linux with 230 security fixes, among the largest patch batches in recent Chrome history. The headline flaw is CVE-2026-87491, a Medium-severity out-of-bounds write in the V8 JavaScript and WebAssembly engine that Google confirmed is exploited in the wild; it was reported by Jihyeon Jeong of Compsec Lab at Seoul National University for a $2,500 bounty. The release also closes five Critical-rated flaws, including CVE-2026-87464, CVE-2026-87488, CVE-2026-87438, CVE-2026-87527, and CVE-2026-87628, mostly use-after-free and out-of-bounds write bugs in WebGL and Cast, plus 43 High-severity issues across ANGLE, PDFium, V8, DevTools, and Payments. Several bugs were surfaced with AI-assisted discovery tools, including OpenAI's Codex Security team, and top bounties reached $5,000 for CVE-2026-87504.
- CVE-2026-87491 is a V8 out-of-bounds write confirmed exploited in the wild despite Medium rating
- V8 memory-corruption bugs are often chained with sandbox escapes to achieve remote code execution
- Five Critical fixes cover use-after-free and out-of-bounds write flaws in WebGL and Cast
- 43 High, 141 Medium, and 41 Low severity fixes span ANGLE, PDFium, ServiceWorker, and Safebrowsing
- Users should update to 153.0.8010.36 or later immediately
- CVEs
- CVE-2026-87491CVE-2026-87464CVE-2026-87488CVE-2026-87438CVE-2026-87527CVE-2026-87628CVE-2026-87512CVE-2026-87585CVE-2026-87504CVE-2026-87640
- Vendors
- Organizations
- Seoul National UniversityCompsec Lab
- AI models
- OpenAI Codex
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87438 | Out-of-Bounds Write in Google Chrome for Android WebGL Enables Sandbox-Escape RCE | 9.6 group max | <1% | ||
| CVE-2026-87491 | Actively Exploited Out-of-Bounds Write in Google Chrome V8 | 8.8 | 4% | KEV | KEV |
From the original article
2 min read at cybersecuritynews.com
Google has rolled out Chrome 153 to the stable channel for Windows, Mac, and Linux, shipping as version 153. 0. 8010.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.