Google Chrome 153 patches a zero-day under active attack, restart required

Google promoted Chrome 153 to the stable channel on Tuesday. The release includes 230 security fixes, and Google rates five of them critical. One line further down the page matters more than any severity rating. "Google is aware that an exploit for CVE-2026-87491 exists in the wild," the company writes.

CVE-2026-87491 is an out-of-bounds write in V8, the JavaScript and WebAssembly engine that Chrome uses to run code on web pages. An out-of-bounds write lets a program write past the memory it was given and overwrite whatever is stored next to it. According to the description, a crafted HTML page is enough for a remote attacker to run code inside the sandbox. Jihyeon Jeong of the Compsec Lab at Seoul National University reported the bug on Aug. 6 and received a $2,500 bounty. Google rates it medium.

Two exploited flaws in the same engine, five days apart

This is the seventh actively exploited Chrome zero-day Google has patched in 2026. Google fixed the sixth one five days ago. That was CVE-2026-85046, a type confusion, also in V8, and also with an exploit circulating.

The five critical flaws are in other components. Four are in WebGL, the interface that renders 3D graphics in the browser, and they are tracked as CVE-2026-87464, CVE-2026-87488, CVE-2026-87438 and CVE-2026-87527. The fifth, CVE-2026-87628, is in Cast, which sends browser content to a television. The credits on the longer list are worth a look on their own. Google names automated bug-hunting systems such as Big Sleep, and one entry came from OpenAI Codex Security.

Why the fix has not reached you yet

Google says in the same post that the release "will roll out over the coming days/weeks". Chrome updates arrive in stages rather than on every machine at once. The second point leaves more devices exposed. Chrome downloads an update in the background but does not run it until the browser is fully closed and opened again. Google's own administrator documentation states this, and the default period before the relaunch prompt turns insistent is one week.

Anyone who keeps the browser open for days, with dozens of tabs and no restart, is still running the old binary. In that state the message "Chrome is up to date" says nothing about which build is actually running.

Edge, Brave, Opera and Vivaldi are affected too

V8 is part of Chromium, which underpins nearly every major browser apart from Firefox and Safari. Microsoft Edge, Brave, Opera and Vivaldi ship the same fix under their own version numbers and on their own schedule, so each one needs its own check. We looked at how slowly a patch can reach a vendor browser, using Samsung Internet as the example.

Chrome 153 begins the two-week release cycle

This version also changes the release rhythm. Beta and stable builds now ship every two weeks instead of every four, across desktop, Android and iOS. Chrome 154 is due on Sept. 22. That means twice as many relaunch prompts, and a shorter path for security fixes.

How to check your version

Open chrome://settings/help, where the browser checks for updates and downloads them right away. If a "Relaunch" button appears, that click is the step that matters, because everything before it was only the download. The version shown afterwards should read 153.0.8010.36 or .37, and 153.0.8010.36 on Linux.

If the line still shows a 152 build and nothing happens, the staged rollout has not reached the machine yet. Trying again later in the day is the only option. Attacks using crafted files are not limited to desktop browsers, either. Samsung's image decoder showed the same thing days ago, and AI browsers proved vulnerable on this front in August.