Chrome 153 Zero-Day Patch Bundles 230 Fixes in Google's First Two-Week Release
Google has shipped Chrome 153 to the stable channel with fixes for 230 security vulnerabilities. The Chrome 153 zero-day patch covers CVE-2026-87491, an out-of-bounds write in the browser's V8 engine that Google confirms is already being exploited in attacks. Patched builds are 153.0.8010.36 on Linux and 153.0.8010.36/.37 on Windows and Mac. Google published the stable channel update on Tuesday, September 8, 2026, and the rollout will reach users over the coming days and weeks.
V8 is the JavaScript and WebAssembly engine that executes the code behind every page a user opens, which makes it a recurring target for memory-safety bugs. An out-of-bounds write lets the engine place data past the end of a memory buffer it has allocated, and an attacker who controls that overflow can corrupt adjacent memory and redirect what the program does next. Google's advisory and the NIST National Vulnerability Database entry describe a remote attacker executing arbitrary code inside Chrome's sandbox by loading a crafted HTML page.
Inside the Chrome 153 Zero-Day
Severity labels for the bug differ by tracker. Chromium's own scale rates CVE-2026-87491 as medium, the flaw carries a CVSS score of 8.8, and Tenable's CVE entry lists critical and high ratings for it. The attacker's code runs inside Chrome's sandbox, the isolated process that holds each site, so one exploit of this kind does not by itself hand over the whole machine. That containment helps explain why a flaw with a live exploit can still sit below critical.
Google's advisory does not name the attackers or the targets, and the company has not said whether the exploitation is targeted at specific organisations or broad. The same pattern held for CVE-2026-85046 in early September, where the disclosure confirmed live attacks without identifying a threat group or a victim profile.
The Chrome 153 zero-day was reported by Jihyeon Jeong, a research intern at the Compsec Lab at Seoul National University. Google's advisory carries its standard note that access to bug details and links may stay restricted until most users have installed the fix, a delay that limits how quickly a working exploit can be reconstructed while the patch spreads. The public record of how the bug works will therefore lag the patch itself, and anyone still on an older build is exposed during that gap.
Seventh Exploited Flaw of the Year
CVE-2026-87491 is the seventh Chrome zero-day Google has patched in 2026, meaning the company confirmed attacks before it had a fix available. The sixth, CVE-2026-85046, was a type confusion flaw in V8 that the September 3 update for Chrome 152 fixed alongside 11 other vulnerabilities. Earlier entries on the 2026 list were CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281 and CVE-2026-11645. The two most recent V8 fixes arrived five days apart, and both were exploited before they were patched.
The scale of the two releases differs sharply as well. Chrome 152 carried a dozen fixes on September 3; Chrome 153 carries 230. The count covers the whole release, not the single exploited bug, and Google has published the full list in its stable channel post. Most of those flaws carry no public detail until users have updated.
Chrome 153 is also the first stable release under Google's two-week cadence, halved from the previous four-week cycle. Chrome 154 is due September 22. Organisations that need longer validation windows can remain on the Extended Stable channel, which keeps updating every eight weeks. The faster train moves security fixes into stable sooner, and it cuts the testing window for administrators roughly in half.
The gap matters most for slow-moving installations. Devices pinned to Extended Stable will not see this build for weeks, and NVD's description covers every Chrome version below 153.0.8010.36, so the vulnerable range includes any browser that has not yet pulled the September update. That window is the practical cost of holding back a security release for extra testing.
What Users Should Check
Chrome checks for updates on its own, but a downloaded patch only takes effect after the browser restarts, and a window left open for days can keep the vulnerable build running without any visible sign. The safest way to confirm the version is the browser itself, since trackers list the build numbers slightly differently: Google's advisory gives .36 for Linux and .36/.37 for both Windows and Mac, while some vulnerability databases assign .36 to Windows and .37 to macOS.
| Platform | Patched version |
|---|---|
| Linux | 153.0.8010.36 |
| Windows | 153.0.8010.36/.37 |
| macOS | 153.0.8010.36/.37 |
- Desktop: open Settings, go to About Chrome, let the update finish, then restart.
- Android: install the update through Google Play, then close and reopen the app.
- iOS: the same rollout window applies through the App Store.
- Managed fleets: confirm whether devices sit on the standard stable channel or on Extended Stable, which moves every eight weeks.
The exposure is not limited to Chrome. Because CVE-2026-87491 sits in V8, the same engine embedded in Microsoft Edge, Brave, Opera and other Chromium-based browsers is affected, and each of those products depends on its own vendor to adopt the fix. Users of those browsers receive it on a different timetable, and any lag leaves a flaw that is already being exploited in the wild in place on their machines.
CISA's Known Exploited Vulnerabilities listing gives federal civilian agencies until September 23, 2026 to confirm the update is applied across their fleets. KEV entries also shape how private organisations rank their own remediation queues, which is why a two-week deadline on a medium-rated flaw still pushes it to the front of most patching schedules.
Why this matters
For anyone running Chrome on a desktop or phone, installing the update is the entire remedy. The Chrome 153 zero-day needs nothing from the user beyond opening a page an attacker controls, and that exploit is already in circulation. The two-week cadence speeds routine patching, and it also means users who ignore update prompts fall behind twice as fast. Checking the About Chrome page and restarting the browser separates a machine running the fixed build from one running a build that is known to be under attack.
Photo by Zulfugar Karimov on Unsplash
Related Articles
- Microsoft Patch Tuesday Sets Record With 200 Security Fixes in June Update
- Apple's iOS 26.5.2 Security Update Patches 29 Vulnerabilities as AI Threats Accelerate
- Google Identifies First AI-Developed Zero-Day Exploit Used by Threat Actors
✔Human Verified
Researched and cross-referenced against primary sources by the Bytevyte editorial team. This article was generated with the assistance of artificial intelligence and reviewed by the Bytevyte editorial team.