Chrome 153 Fixes 230 Vulnerabilities, Including One 0-Day Exploited in the Wild
Google shipped Chrome 153 with 230 fixes, including CVE-2026-87491, a V8 out-of-bounds write zero-day exploited in the wild.
Chrome 153 (153.0.8010.36/.37) rolls out to Windows, Mac, and Linux with 230 security fixes, among the largest patch batches in recent Chrome history. The headline flaw is CVE-2026-87491, a Medium-severity out-of-bounds write in the V8 JavaScript and WebAssembly engine that Google confirmed is exploited in the wild; it was reported by Jihyeon Jeong of Compsec Lab at Seoul National University for a $2,500 bounty. The release also closes five Critical-rated flaws, including CVE-2026-87464, CVE-2026-87488, CVE-2026-87438, CVE-2026-87527, and CVE-2026-87628, mostly use-after-free and out-of-bounds write bugs in WebGL and Cast, plus 43 High-severity issues across ANGLE, PDFium, V8, DevTools, and Payments. Several bugs were surfaced with AI-assisted discovery tools, including OpenAI's Codex Security team, and top bounties reached $5,000 for CVE-2026-87504.
- CVE-2026-87491 is a V8 out-of-bounds write confirmed exploited in the wild despite Medium rating
- V8 memory-corruption bugs are often chained with sandbox escapes to achieve remote code execution
- Five Critical fixes cover use-after-free and out-of-bounds write flaws in WebGL and Cast
- 43 High, 141 Medium, and 41 Low severity fixes span ANGLE, PDFium, ServiceWorker, and Safebrowsing
- Users should update to 153.0.8010.36 or later immediately
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-87438 | Out-of-Bounds Write in Google Chrome for Android WebGL Enables Sandbox-Escape RCE CVE-2026-87438 is an out-of-bounds write (CWE-787) in the WebGL component of Google Chrome running on Android. A remote attacker can trigger the flaw by persuading a user to open a crafted HTML page, requiring no privileges and only user interaction. Successful exploitation yields arbitrary code execution outside the browser sandbox, meaning the attacker escapes Chrome's renderer sandbox and compromises the device at a level beyond the web content, with high confidentiality, integrity and availability impact. Users of Chrome on Android prior to 153.0.8010.36 are affected; the fix ships in Chrome 153, a release that includes roughly 230 security fixes. Exploitation of this specific WebGL flaw has not been documented so far (not in CISA KEV, EPSS ~0.4%, no public PoC); the actively exploited zero-day referenced in recent headlines is a separate V8 bug that was patched in the same Chrome 153 release. Do: Update Chrome on Android to 153.0.8010.36 or later (Play Store > Settings > About Chrome, or rely on auto-update) and confirm managed/fleet Android devices have received the update. As interim mitigation, avoid opening untrusted web pages until patched. Note that Chrome 153 also fixes an actively exploited V8 zero-day, so applying this update promptly is important regardless of this bug's exploitation status. | 9.6 group max | <1% |
| mass≈ billions of users (Chrome for Android is the default/primary browser on the world's largest mobile OS) | ||
| CVE-2026-87491 | Actively Exploited Out-of-Bounds Write in Google Chrome V8 CVE-2026-87491 is an out-of-bounds write (CWE-787) in the V8 JavaScript engine in Google Chrome, fixed in Chrome 153.0.8010.36, which Google shipped alongside roughly 230 other security fixes. An attacker can trigger the flaw remotely by luring a user (user interaction required) into opening a crafted HTML page that corrupts memory in V8. Successful exploitation allows the attacker to execute arbitrary code inside the Chrome browser sandbox, which constrains but does not eliminate the impact. All Google Chrome users running versions prior to 153.0.8010.36 are affected; because the flaw resides in V8, CISA tracks it as 'Google Chromium V8', and other Chromium-based browsers may inherit the fix in their own updates. The flaw is being actively exploited in the wild — it is the seventh actively exploited Chrome zero-day of 2026 and was added to CISA's KEV catalog on 2026-09-09 — though no public proof-of-concept is known and ransomware use is unknown. Do: Update Google Chrome to 153.0.8010.36 or later immediately (open Help > About Google Chrome to force the update and relaunch), and verify the version on all endpoints. Also patch headless or automated Chrome deployments (CI runners, scrapers, kiosks, CDP-based tooling) that may lag auto-updates, and prioritize remediation per CISA KEV and BOD 26-04 requirements for federal systems. No public PoC is known and ransomware use is unknown, but confirmed in-the-wild exploitation warrants urgent patching. | 8.8 | <1% | KEV |
| massbillions of installations (Chrome's install base exceeds 3 billion users) |
Full article450 words · extracted from cybersecuritynews.com · click to collapse
Google has rolled out Chrome 153 to the stable channel for Windows, Mac, and Linux, shipping as version 153.0.8010.36 on Linux and 153.0.8010.36/.37 on Windows and Mac.
The update will reach users over the coming days and weeks and includes 230 security fixes, one of the largest patch batches in recent Chrome release history.
Actively Exploited 0-Day
The most critical issue in this release is CVE-2026-87491, a Medium-severity out-of-bounds write vulnerability in V8, Chrome’s JavaScript and WebAssembly engine. Google has confirmed that an exploit for this flaw already exists in the wild, making immediate updates essential for all users.
Jihyeon Jeong of Compsec Lab at Seoul National University reported the bug and earned a $ 2,500 bounty for the discovery. Despite its “Medium” classification, active exploitation of a V8 memory-corruption bug matters, since V8 flaws are often chained with sandbox-escape vulnerabilities to achieve remote code execution.
Beyond the zero-day, Chrome 153 closes five Critical-rated vulnerabilities, most involving use-after-free and out-of-bounds write conditions in WebGL and Cast components. Notable entries include CVE-2026-87464, CVE-2026-87488, CVE-2026-87438, CVE-2026-87527, and CVE-2026-87628, several of which Google’s security team discovered internally.
The update also resolves 43 High-severity bugs spanning ANGLE, PDFium, V8, Views, DevTools, Web Authentication, and Payments modules. Several of these, including CVE-2026-87512 in ANGLE and CVE-2026-87585 in PDFium, carried bounty rewards of up to 2,500 dollars.
External researchers flagged several high-severity issues using AI-assisted tools, including OpenAI’s Codex Security team, reflecting the growing role of automated vulnerability discovery in browser security.
The bulk of the release consists of 141 Medium-severity fixes and 41 Low-severity fixes, covering categories such as incorrect authorization, missing authorization, UI misrepresentation, and information leaks across components like FileSystem, ServiceWorker, Extensions, Safebrowsing, and Payments.
One standout bounty went to CVE-2026-87504, a use-after-free in Core rewarded at 5,000 dollars, while CVE-2026-87640 in WebView earned 3,000 dollars, both credited to the same researcher.
Why This Update Is Important
With 230 fixes packed into a single release and confirmed in-the-wild exploitation of at least one flaw, Chrome 153 represents a high-priority update for enterprises and individual users alike.
Google continues to rely on tools like AddressSanitizer, MemorySanitizer, and libFuzzer to catch these issues before they reach production, but the scale of this fix batch underscores how actively browser engines remain a target for both researchers and threat actors.
Users should update to build 153.0.8010.36 or later without delay.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
Guru Baranhttps://cybersecuritynews.com
Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cybersecuritynews.com/chrome-153-released/