Chromium: 25 Vulnerabilities Patched, Including Exploited V8 Zero-Day
Key findings • 25 vulnerabilities in Chromium disclosed on September 9, 2026, patched in Chrome 153.0.8010.36. • Batch includes critical flaws like use-after-free, out-of-bounds writes, and t…
Key findings
- 25 vulnerabilities in Chromium disclosed on September 9, 2026, patched in Chrome 153.0.8010.36.
- Batch includes critical flaws like use-after-free, out-of-bounds writes, and type confusion.
- CVE-2026-87639, a V8 engine vulnerability, was actively exploited in the wild as a zero-day.
- Multiple authorization bypass vulnerabilities affect components like PushAPI, FileSystem, and Omnibox.
- Memory corruption flaws in WebPackaging, Web Authentication, and Media allow for arbitrary code execution.
On September 9, 2026, Google released Chrome version 153.0.8010.36 to address a significant batch of 25 vulnerabilities disclosed on the same day. This coordinated disclosure included flaws ranging from Low to Critical severity, with a notable concentration of memory corruption and authorization bypass issues. The update is crucial for all users as at least one of these vulnerabilities was actively exploited in the wild as a zero-day.
Several vulnerabilities fall into the category of memory corruption. Use-after-free bugs were identified in WebPackaging (CVE-2026-87639, CVE-2026-87634), Web Authentication (CVE-2026-87646), and Views (CVE-2026-87633), with the latter two allowing for arbitrary code execution. An out-of-bounds write in the Media component (CVE-2026-87638) also posed a critical risk, potentially leading to code execution. Additionally, an uninitialized resource in the GPU component (CVE-2026-87647) could allow a compromised renderer process to read memory outside the sandbox. A type confusion vulnerability in the V8 engine (CVE-2026-87612) is particularly concerning, as it allows for arbitrary code execution within the sandbox.
Authorization flaws were also prevalent across various components. Incorrect authorization in PushAPI (CVE-2026-87652), Paint (CVE-2026-87651), Payments (CVE-2026-87635), DeviceBoundSessionCredentials (CVE-2026-87626), and Omnibox (CVE-2026-87610) could lead to various impacts, including bypassing web origin policies, spoofing UI elements, or leaking sensitive information. Missing authorization vulnerabilities were found in FileSystem (CVE-2026-87611, CVE-2026-87603) and SiteIsolation (CVE-2026-87606), potentially allowing attackers to obtain cross-origin data or bypass site isolation.
The batch also includes several other notable vulnerabilities. Clickjacking in Downloads (CVE-2026-87655) and UI misrepresentation in Payments (CVE-2026-87635) could be exploited through social engineering to spoof UI elements or obtain sensitive information. An integer overflow in WebRTC (CVE-2026-87630) could lead to memory reading within the sandbox. Observable discrepancies in DOM (CVE-2026-87623) and Prefetch (CVE-2026-87619) could also be used to obtain sensitive or cross-origin data.
Notably, security researchers have highlighted that CVE-2026-87639, a use-after-free vulnerability in the V8 engine, was actively exploited in the wild as a zero-day prior to the patch release. This vulnerability, along with others like CVE-2026-87628 (Use after free in Cast), were part of a larger disclosure of 230 security fixes in Chrome 153. The prompt patching of these vulnerabilities, especially the zero-day, is critical for user security.
Google Chrome version 153.0.8010.36 is the patched version for this batch of vulnerabilities. Users are strongly advised to update their browsers immediately to mitigate the risks associated with these flaws, particularly the actively exploited zero-day. The coordinated disclosure of these numerous vulnerabilities underscores the ongoing efforts to secure the Chromium ecosystem.
The sheer volume and severity of vulnerabilities patched in this single release highlight the importance of timely updates for web browsers. Users should remain vigilant and ensure their browsers are always up-to-date to protect against potential exploitation of newly discovered security weaknesses.
The patched versions are 153.0.8010.36 for Linux and 153.0.8010.36/.37 for Windows and Mac.
The vulnerabilities patched include: CVE-2026-87655, CVE-2026-87652, CVE-2026-87651, CVE-2026-87647, CVE-2026-87646, CVE-2026-87639, CVE-2026-87638, CVE-2026-87635, CVE-2026-87634, CVE-2026-87633, CVE-2026-87632, CVE-2026-87630, CVE-2026-87629, CVE-2026-87628, CVE-2026-87626, CVE-2026-87623, CVE-2026-87619, CVE-2026-87615, CVE-2026-87614, CVE-2026-87612, CVE-2026-87611, CVE-2026-87610, CVE-2026-87606, CVE-2026-87603, CVE-2026-87594.