Google released Chrome version 153 to the Stable channel for Windows, macOS, and Linux, including 230 security fixes and addressing CVE-2026-87491, a zero-day vulnerability currently being exploited in the wild.
Because of the unusually large number of fixes, consumers and enterprise defenders should update their browsers promptly.
The desktop releases are version 153.0.8010.36 for Linux and 153.0.8010.36/.37 for Windows and macOS. Google said the rollout will happen progressively over the coming days and weeks. Administrators should verify the deployed version rather than assuming that automatic updates have reached every managed endpoint.
Google’s disclosure policy means that vulnerability records and bug links may remain restricted until a majority of users are protected. Restrictions may also persist if an issue affects a third-party library that remains unpatched in other dependent projects, which limits immediate public analysis of the exploit for defenders.
CVE-2026-87491 is classified as a medium-severity out-of-bounds write vulnerability in V8, Chrome’s JavaScript and WebAssembly engine. Such memory-safety defects can occur when code writes outside an allocated memory boundary. In a browser attack chain, a malicious site could exploit a V8 flaw to corrupt memory in the renderer process.
The practical impact depends on exploit reliability, browser mitigations, and, in serious cases, the presence of an additional sandbox escape vulnerability. Google has not provided technical details on exploitation or attributed the in-the-wild activity.
Despite its medium severity rating, confirmed exploitation alters the operational priority for security teams. They should treat this as an active exploit event by accelerating Chrome updates, identifying unmanaged devices, and ensuring that Chrome-derived browsers are evaluated separately, as their patch schedules may differ.
Chrome version 153 also addresses five critical vulnerabilities, four of which affect WebGL. These include two use-after-free vulnerabilities, an out-of-bounds write, and a buffer overflow.
The fifth critical flaw is a use-after-free in Cast. This release also contains several high-severity memory-safety issues across components such as ANGLE, PDFium, Codecs, WebGL, V8, Payments, and Web Authentication. Notably, high-severity issues in V8 include use-after-free and type-confusion defects, making it a key area of concern in this update.
Medium- and low-severity fixes address security boundaries and user-protection features, including authorization failures in FileSystem, Extensions, Site Isolation, WebUI, and Downloads; race conditions; information disclosures; clickjacking; UI misrepresentation; and vulnerabilities in Safe Browsing, CORS, WebRTC, and certificate validation.
The exploitability of these issues varies, but the wide range of affected subsystems highlights the importance of rapid, centrally managed updates.
To deploy the fix, open Chrome’s About Google Chrome page to trigger an update, restart the browser, and confirm the installed build. Enterprise teams should utilize their update management platform to enforce the current Stable version, monitor version compliance, and prioritize endpoints used for privileged administration.
Google will keep some details about the issues restricted until most users have received the patched release, a practice designed to reduce the window for opportunistic exploitation.
CVE Details
| CVE | Severity | Affected component | Vulnerability type |
|---|---|---|---|
| CVE-2026-87491 | Medium | V8 | Out-of-bounds write |
| CVE-2026-87464 | Critical | WebGL | Use-after-free |
| CVE-2026-87488 | Critical | WebGL | Use-after-free |
| CVE-2026-87438 | Critical | WebGL | Out-of-bounds write |
| CVE-2026-87527 | Critical | WebGL | Buffer overflow |
| CVE-2026-87628 | Critical | Cast | Use-after-free |
| CVE-2026-87512 | High | ANGLE | Use-after-free |
| CVE-2026-87585 | High | PDFium | Double free |
| CVE-2026-87444 | High | Codecs | Memory corruption |
| CVE-2026-87650 | High | WebGL | Out-of-bounds read |
| CVE-2026-87654 | High | ANGLE | Buffer overflow |
| CVE-2026-87621 | High | ANGLE | Out-of-bounds write |
| CVE-2026-87587 | High | V8 | Use-after-free |
| CVE-2026-87564 | High | V8 | Type confusion |
| CVE-2026-87612 | High | V8 | Type confusion |
| CVE-2026-87536 | High | V8 | Use-after-free |
| CVE-2026-87657 | Medium | V8 | Use-after-free |
| CVE-2026-87625 | Medium | V8 | Use-after-free |
| CVE-2026-87630 | Medium | WebRTC | Integer overflow |
| CVE-2026-87579 | Medium | WebRTC | Buffer overflow |
| CVE-2026-87632 | Medium | SanitizerAPI | Cross-site scripting |
| CVE-2026-87489 | Low | V8 | Memory corruption |
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
A decade-old authentication bypass in OpenSSH on musl-based Linux lets attackers log into accounts that…
Bitdefender researchers have revealed a vulnerability called GhostMap that affects Android devices. This vulnerability can…
Microsoft has announced a vulnerability in Windows Paint that could let unauthenticated attackers execute malicious…
An autonomous penetration-testing framework linked to South Korean banking breaches and cloud supply-chain attacks is…
Shopify is making IP allowlisting mandatory for all public apps to limit abuse of stolen…
OpenAI has introduced GPT-6 Cyber, a security-focused model built to find and validate exploitable vulnerabilities…