Google Chrome 153 Released With 230 Security Fixes, Including Actively Exploited 0-Day
Google Chrome 153 addresses 230 vulnerabilities, including CVE-2026-87491, a medium-severity out-of-bounds write in the V8 engine exploited in the wild.
Google has released Chrome 153 to its stable channel for Windows, Mac, and Linux, with version numbers 153.0.8010.36 on Linux and 153.0.8010.36/.37 on Windows and Mac. This significant update addresses a total of 230 security vulnerabilities, marking one of the largest batches of fixes in recent Chrome release history. The update is expected to reach users gradually over the coming days and weeks.
The most critical issue highlighted in this release is CVE-2026-87491, a medium-severity out-of-bounds write vulnerability affecting V8, Chrome's JavaScript and WebAssembly engine. Google has confirmed that this flaw is already being exploited in the wild, making immediate updates essential for all users. The vulnerability was reported by Jihyeon Jeong of Compsec Lab at Seoul National University, who received a $2,500 bounty for their discovery. While classified as "Medium" severity, active exploitation of a V8 memory-corruption bug is concerning, as such flaws are often chained with sandbox-escape vulnerabilities to achieve remote code execution.
Beyond the zero-day, Chrome 153 also resolves five critical vulnerabilities, primarily involving use-after-free and out-of-bounds write conditions within the WebGL and Cast components. Notable among these are CVE-2026-87464, CVE-2026-87488, CVE-2026-87438, CVE-2026-87527, and CVE-2026-87628. Several of these critical issues were discovered internally by Google's security team.
The update further addresses 43 high-severity bugs across various modules, including ANGLE, PDFium, V8, Views, DevTools, Web Authentication, and Payments. Some of these high-severity vulnerabilities, such as CVE-2026-87512 in ANGLE and CVE-2026-87585 in PDFium, also carried bounty rewards of up to $2,500. The growing role of AI in vulnerability discovery is evident, with external researchers flagging several high-severity issues using AI-assisted tools, including those from OpenAI's Codex Security team.
The vast majority of the remaining fixes, comprising 141 medium-severity and 41 low-severity vulnerabilities, cover a range of issues including incorrect authorization, missing authorization, UI misrepresentation, and information leaks. These fixes span components like FileSystem, ServiceWorker, Extensions, Safebrowsing, and Payments.
Significant bug bounties were also awarded for other vulnerabilities, including $5,000 for CVE-2026-87504, a use-after-free flaw in the Core component, and $3,000 for CVE-2026-87640 in WebView. Both of these were credited to the same researcher.
With 230 security fixes and confirmed in-the-wild exploitation of at least one vulnerability, Chrome 153 stands out as a high-priority update for both enterprises and individual users. Google's continued reliance on advanced tools like AddressSanitizer, MemorySanitizer, and libFuzzer for vulnerability detection underscores the ongoing challenges in browser security. However, the sheer volume of fixes in this release highlights that browser engines remain a prime target for both security researchers and malicious actors.
Users are strongly advised to update to build 153.0.8010.36 or a later version as soon as possible to protect themselves from these newly patched vulnerabilities.