Google shipped Chrome 153 on September 9, patching CVE-2026-87491, an out-of-bounds write bug in the V8 JavaScript engine that attackers were already exploiting in the wild. A malicious or compromised webpage could trigger the flaw to run code inside Chrome’s sandbox. It’s the seventh Chrome zero-day Google has had to patch under active attack this year, and the second inside a single week. If you haven’t restarted Chrome in the last day or two, do it now.
What CVE-2026-87491 Actually Does
The bug lives in V8, the engine that runs JavaScript and WebAssembly inside Chrome. It’s a memory-safety flaw called an out-of-bounds write, where code writes data past the edges of a buffer it was allocated, which an attacker can turn into arbitrary code execution. Google’s own advisory says it is “aware that an exploit for CVE-2026-87491 exists in the wild,” about as close to a confirmed active-exploitation statement as the company gets. Security researcher Jihyeon Jeong of Compsec Lab at Seoul National University reported the bug on August 6 and earned a $2,500 bounty for it, according to Help Net Security’s writeup.
The fix landed in Chrome 153.0.8010.36 for Windows and Linux, and 153.0.8010.36 or .37 for macOS, as part of a stable release that also closed 230 other security issues, per The Hacker News. Google rates the severity as medium, which sounds low for an actively exploited remote code execution bug, but that reflects the fact that an attacker still has to break out of Chrome’s sandbox to do real damage, not that the bug itself is minor.
Why This Keeps Happening
This is Chrome’s seventh zero-day patched under active exploitation in 2026, and it landed less than a week after CVE-2026-85046, another V8 bug Google fixed on September 4. Two separate, unrelated V8 flaws getting weaponized in the same week isn’t really a coincidence. V8 is one of the most heavily scrutinized pieces of code on the internet, by defenders and attackers alike, and it sits underneath every Chromium-based browser, not just Chrome itself. CISA added the earlier bug to its Known Exploited Vulnerabilities catalog with a September 18 remediation deadline for federal agencies. Expect CVE-2026-87491 to get the same treatment shortly.
What to Do About It
Chrome updates itself in the background, but the fix only takes effect after a full restart of the browser, not just closing and reopening a tab. Check chrome://settings/help, confirm you’re running 153.0.8010.36 or later on Windows and Linux (153.0.8010.36 or .37 on macOS), and restart if you’re not already there. The same advice applies to Chromium-based browsers like Edge, Brave, Opera, and Vivaldi once their vendors ship the equivalent patch, since they all run on the same V8 engine.
There’s no other action to take. This isn’t a bug you can work around by changing a setting or avoiding certain sites, since the trigger is just a crafted HTML page loading in the browser. Restarting Chrome is the whole fix.
