Google security advisory (AV26-904)
Google patches Chrome CVE-2026-87491, exploited in the wild and added to CISA's KEV; users should update to 153.0.8010.37.
Google released a stable channel desktop update fixing vulnerabilities in Chrome prior to 153.0.8010.37. Google confirmed that an exploit for CVE-2026-87491 exists in the wild, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 9, 2026. The Canadian Centre for Cyber Security issued advisory AV26-904 urging users and administrators to apply the update.
- Exploit for CVE-2026-87491 confirmed in the wild.
- CISA added CVE-2026-87491 to the KEV catalog on September 9, 2026.
- Patch via Chrome stable 153.0.8010.37 or later.
- CVEs
- CVE-2026-87491
- Vendors
- Products
- Chrome
- Organizations
- CISACanadian Centre for Cyber Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-87491 | Actively Exploited Out-of-Bounds Write in Google Chrome V8 | 8.8 | 4% | KEV | KEV |
From the original article
1 min read at cyber.gc.ca
Serial Number: AV26-904 Date: September 9, 2026 As of September 8, 2026, Google is affected by vulnerabilities in the following product: Chrome Prior to 153. 0. 8010.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.