Google has shipped Chrome 153 to the stable channel, closing 230 security vulnerabilities including one that attackers were already exploiting before the company knew it existed. It is the seventh actively exploited Chrome zero-day Google has patched in 2026, and the pattern behind it is becoming hard to ignore.
What Happened
The vulnerability, tracked as CVE-2026-87491, is an out-of-bounds write flaw in V8, the engine that runs JavaScript and WebAssembly inside every Chrome tab. In its advisory, Google said it is “aware that an exploit for CVE-2026-87491 exists in the wild,” though the company has not disclosed who is using it, which organizations have been targeted, or how the exploit is being delivered.
The flaw was reported by Jihyeon Jeong, a research intern at Seoul National University’s Compsec Lab, who received a $2,500 bug bounty for the find. Google shipped a fix roughly two days later, rolling out Chrome 153.0.8010.36 for Windows and Linux and 153.0.8010.37 for Mac. Because a malicious or compromised web page can trigger the bug, memory corruption in V8 can hand an attacker code execution inside Chrome’s sandbox, a foothold that becomes more dangerous if paired with a separate sandbox-escape flaw.
A Pattern Centered on V8
CVE-2026-87491 is the second exploited zero-day Google has patched in under a week. On September 3, it fixed CVE-2026-85046, a V8 type-confusion bug serious enough that the U.S. Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog, giving federal agencies until September 18 to patch.
Counting both of those, Chrome’s exploited zero-days for 2026 now stand at seven: a CSS use-after-free bug in February, two flaws in March split between the Skia graphics library and V8, a use-after-free in the Dawn WebGPU component in April, a V8 memory-access bug in June, and the two V8 flaws from early September. Four of the seven trace back to V8 specifically, underscoring that the JavaScript engine remains the most valuable entry point for attackers who need to run code inside a browser that a huge share of the world’s internet users have open at any given moment.
Beyond the zero-day, Chrome 153 also fixes five critical-severity bugs in WebGL and Cast, along with 41 high-severity defects. Google says it paid around $23,000 in bug bounties for the 35 externally reported issues in this release, with payouts for roughly two dozen more yet to be finalized.
Why It Matters
Google’s decision to withhold details of how CVE-2026-87491 is being used is standard practice, meant to buy time for the patch to reach users before other attackers can reverse-engineer it from the code changes alone. That window matters because Chrome’s update rollout is staged and can take days to reach every installation, so an organization cannot assume all of its endpoints are protected simply because Google announced a fix.
For everyday users, the practical step is simple: relaunch Chrome so the browser can apply the update it has likely already downloaded in the background, rather than assuming automatic updates alone are enough.
India Relevance
Chrome remains the dominant browser for both desktop and mobile users in India, which means the exposure window created by an actively exploited zero-day affects a large share of the country’s internet population before patches are fully rolled out. Organizations running managed fleets of Windows or Chromebook devices, in particular, should treat this update with the same urgency as any other patch tied to a confirmed in-the-wild exploit.
What Happens Next
Google is unlikely to say more about who was behind the CVE-2026-87491 attacks, consistent with its handling of the six previous 2026 zero-days. What is likely to continue is the broader trend: as Google’s own AI-assisted bug-hunting tools find more obscure flaws in older code, external researchers are still finding high-value bugs in newer, actively exploited territory like V8. With four months left in 2026, Chrome’s zero-day count is on pace to match or exceed recent years.
Conclusion
The seventh exploited zero-day of the year is a reminder that browser engines, and V8 in particular, remain the most contested piece of real estate on the modern web. Updating promptly remains the single most effective defense available to ordinary users.
