Chrome 153 fixes CVE-2026-87491, the seventh exploited V8 zero-day of 2026

August 6, 2026. Jihyeon Jeong, of the Compsec Lab at Seoul National University, reports an out-of-bounds write in the V8 engine to Google. September 8, 2026. Google ships Chrome 153, fixing 230 vulnerabilities, including CVE-2026-87491. September 9, 2026. CISA adds it to the KEV catalog with a remediation deadline of September 23. Why it matters: this is the seventh actively exploited Chrome zero-day since January, and simply visiting a crafted page is enough to trigger the exploit.

An out-of-bounds write in the engine behind every Chromium browser

CVE-2026-87491 is classified CWE-787, out-of-bounds write, in V8, the JavaScript and WebAssembly engine at the core of Chrome. A remote attacker delivers a purpose-built HTML page: when a vulnerable browser processes it, the flaw lets the attacker write past the allocated memory region and corrupt adjacent program state, up to arbitrary code execution.

Two nuances matter. First, Google rates the flaw Medium on its own Chromium severity scale — NVD has not yet published a CVSS score — yet its advisory confirms an exploit exists in the wild. Second, the execution happens inside Chrome’s sandbox, not at the host level: moving from browser compromise to machine compromise normally requires a second flaw, a sandbox escape, whose existence Google has not disclosed for this chain.

That nuance does not soften the urgency. A sandbox exploit already grants access to the browser session’s data and capabilities — cookies, tokens, saved passwords, tab contents — and is a classic first stage of a wider exploitation chain.

Seven zero-days in nine months

The flaw sits in a now well-documented series. CVE-2026-87491 is the seventh actively exploited Chrome zero-day that Google has fixed since the start of 2026. The cadence tightened sharply into autumn: the sixth (a type confusion in V8, CVE-2026-85046) landed on September 4, barely five days earlier.

That pace is not statistical noise. V8 concentrates a disproportionate share of these flaws for a structural reason: it is a C++ component, heavily optimized for performance, whose just-in-time compilers manipulate memory directly. Every optimization adds attack surface, and exploit developers follow. A memory bug in V8 hits every browser built on Chromium — not just Chrome — which makes it a high-yield target.

The full arc of the year is telling. The first zero-day of 2026, CVE-2026-2441, was a use-after-free in CSS, patched in an emergency update on February 13 in Chrome 145. Between the two extremes, every confirmed flaw joined the CISA KEV catalog. Seven zero-days in nine months, two of them in V8 within five days of each other: the pace is no longer noise, it is an operational input for anyone planning patches.

What Chrome 153 changes

Chrome 153.0.8010.36 is available for Linux, and 153.0.8010.36/.37 for Windows and macOS. The update is not limited to the zero-day: it fixes 230 vulnerabilities in total, including five of critical severity and forty-one of high severity. This is a massive cumulative patch, not a targeted fix.

The fix took an unusually fast path to federal action: CISA added CVE-2026-87491 to the KEV catalog on September 9, one day after the patch shipped, and requires U.S. federal civilian agencies to remediate by September 23. That responsiveness reflects the KEV rule: only a genuinely exploited flaw enters it, and its deadline scales with the threat.

The thirty-three-day gap between the August 6 report and the September 8 patch is worth noting. It is a reminder that Google’s responsible disclosure takes time — and that, during that window, an already-exploited flaw circulated with no public fix.

A browser, a perimeter

The frequency of Chrome zero-days reflects a deeper shift. The browser has become the most profitable entry point for an attacker: it executes untrusted code continuously, it holds session tokens, saved passwords and access to internal applications, and it sits on every endpoint in the fleet. A drive-by exploit asks for neither sophisticated phishing nor elaborate interaction — a web page is enough.

That is why teams that treat the browser as just another piece of software understate their exposure. The CVE-2026-87491 fix is not one patch among many: it is the fix for a flaw in the component that executes the largest surface of hostile content in the whole estate.

What to do

The fix is simple; the real question is fleet coverage.

• Update Chrome now. Version 153.0.8010.36 (or .37 depending on platform) removes the flaw. The browser updates itself on restart, but a fleet that forces tabs closed can sit days behind.
• Extend to all of Chromium. Edge, Brave, Opera, Vivaldi and embedded WebViews share V8. An inventory that only covers Chrome leaves flaws open on every other browser in the fleet.
• Prioritize endpoints exposed to unmanaged browsing. Machines that open email, external links, or uncontrolled web pages are first in line for a drive-by attack.
• Watch for symptoms. With no indicators of compromise published by Google, detection is limited to version inventory and anomalies in Chrome processes — repeated renderer crashes, abnormal termination — visible in endpoint telemetry.

One caution for SOC teams: the flaw alone does not escape the sandbox. A full host compromise would therefore run through a chain — CVE-2026-87491 as the first stage, then a second flaw. The absence of a documented escape today does not mean the absence of an escape tomorrow.

In a managed fleet, updating does not depend on user goodwill. Check Chrome’s auto-update policy via GPO, Intune or your MDM: a rule that allows scheduled restarts keeps the fleet from sitting on a vulnerable version for weeks. Apply the same rigor to third-party Chromium browsers — Edge is managed through Microsoft, but Brave, Opera and Vivaldi must be inventoried and versioned explicitly.

Beyond the browser, treat the KEV deadline as a signal for the rest of the fleet. A September 23 federal deadline means the flaw carries a documented, in-the-wild exploit; your own risk register should carry that same date, not a longer one. Patch the browser first, then use the time saved to check whether those same endpoints run any other Chromium-based surface — embedded WebViews in line-of-business apps are the ones most often missed.

There is also an economics point that rarely makes the advisories. A V8 memory bug is a general-purpose primitive that works across tabs, extensions and origins, independent of any particular page layout. That is precisely why attackers keep spending zero-days on it — and why Google’s disclosure cadence, seven fixes in nine months, is now a leading indicator that your patch cycle, not your firewall, is the front line.

Verdict

If you manage a fleet of endpoints running Chrome or any Chromium browser, force the update to 153.0.8010.36 (or .37) before September 23 and audit your V8 browser inventory beyond Chrome alone: an actively exploited V8 zero-day threatens the entire Chromium ecosystem, not a single product. If your policy delays patches for validation, treat this update as an emergency exception — CISA already has by listing it in KEV, and a browser is the application that executes more untrusted content than any other in your fleet.

References

• SecPod — CVE-2026-87491: Google Fixes 7th Exploited Chrome Zero-Day of 2026, September 10, 2026
• The Hacker News — Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox, September 9, 2026
• Security Affairs — Google fixes the seventh actively exploited Chrome zero-day of 2026
• CISA — Known Exploited Vulnerabilities Catalog