Chrome 153 Patches Seventh Zero-Day of 2026
Google Chrome 153 released to stable channel with patches for 230 vulnerabilities, including one actively exploited zero-day CVE-2026-87491 is an out-of-bounds write flaw in Chrome's V8 JavaScript/WebAssembly engine, confirmed exploited in the wild Five critical-severity bugs were fixed, primarily use-after-free, out-of-bounds write, and buffer overflow issues in WebGL and Cast This marks the seventh zero-day patched in Chrome during 2026, highlighting an unusually high vulnerability rate Only 3
Analysis
TL;DR
- Google Chrome 153 released to stable channel with patches for 230 vulnerabilities, including one actively exploited zero-day
- CVE-2026-87491 is an out-of-bounds write flaw in Chrome's V8 JavaScript/WebAssembly engine, confirmed exploited in the wild
- Five critical-severity bugs were fixed, primarily use-after-free, out-of-bounds write, and buffer overflow issues in WebGL and Cast
- This marks the seventh zero-day patched in Chrome during 2026, highlighting an unusually high vulnerability rate
- Only 35 of the 230 vulnerabilities were reported by external researchers, with approximately $23,000 in bug bounty rewards distributed
Why It Matters
Chrome's vulnerability count for 2026 is exceptionally high, signaling potential systemic issues in the browser's codebase or increasing attack surface as web technologies grow more complex. For AI practitioners and security professionals, this underscores the importance of keeping browsers updated, especially given that V8 engine flaws can be weaponized to execute arbitrary code through malicious web pages—a common attack vector in AI-driven phishing and supply chain compromise scenarios.
Technical Details
- CVE-2026-87491: Medium-severity out-of-bounds write in the V8 JavaScript and WebAssembly engine, actively exploited in the wild; reported by Jihyeon Jeong of Compsec Lab, Seoul National University
- Critical vulnerabilities: Five critical bugs patched, including four in WebGL (use-after-free, out-of-bounds write, buffer overflow) and one use-after-free in Cast
- High-severity defects: 41 high-severity issues resolved, spanning use-after-free, out-of-bounds read, incorrect/missing authorization, and race conditions
- Medium/low-severity bugs: Over 180 medium- and low-severity vulnerabilities patched, including information leaks, UI misrepresentation, clickjacking, improper validation, and uninitialized resources
- Chrome 153 versions: 153.0.8010.36/.37 for Windows and macOS; 153.0.8010.36 for Linux
Industry Insight
- The seven zero-days in a single year suggest Chrome's attack surface is expanding faster than its security remediation pipeline can keep pace, warranting closer scrutiny of browser security engineering practices across the industry
- Organizations should enforce automatic browser updates and consider endpoint detection and response (EDR) tools capable of identifying exploitation attempts targeting V8 engine vulnerabilities
- The low ratio of external to internal bug reports (35 external vs. 230 total) indicates Google's internal security testing is catching the majority of issues, but also highlights the value of continued bug bounty investment to broaden the researcher community
Disclaimer: The above content is generated by AI and is for reference only.