AI Security AI安全 1d ago Updated 23h ago 更新于 23小时前 46

Chrome 153 Patches Seventh Zero-Day of 2026 Chrome 153 修复2026年第七个零日漏洞

Google Chrome 153 released to stable channel with patches for 230 vulnerabilities, including one actively exploited zero-day CVE-2026-87491 is an out-of-bounds write flaw in Chrome's V8 JavaScript/WebAssembly engine, confirmed exploited in the wild Five critical-severity bugs were fixed, primarily use-after-free, out-of-bounds write, and buffer overflow issues in WebGL and Cast This marks the seventh zero-day patched in Chrome during 2026, highlighting an unusually high vulnerability rate Only 3 Google Chrome 153正式发布,一次性修复230个安全漏洞,包含一个已在野外被利用的零日漏洞 零日漏洞CVE-2026-87491位于V8 JavaScript/WebAssembly引擎,属于越界写入缺陷,由首尔大学Compsec Lab研究员发现 2026年Chrome已修复第7个零日漏洞,另有5个关键漏洞(WebGL/Cast模块)和41个高危漏洞 漏洞类型涵盖use-after-free、缓冲区溢出、竞态条件、授权缺失等,超过180个为中低危漏洞 Google仅支付35个外部报告漏洞约23,000美元赏金,建议用户立即更新至153.0.8010.36/.37版本

72
Hot 热度
62
Quality 质量
58
Impact 影响力

Analysis 深度分析

TL;DR

  • Google Chrome 153 released to stable channel with patches for 230 vulnerabilities, including one actively exploited zero-day
  • CVE-2026-87491 is an out-of-bounds write flaw in Chrome's V8 JavaScript/WebAssembly engine, confirmed exploited in the wild
  • Five critical-severity bugs were fixed, primarily use-after-free, out-of-bounds write, and buffer overflow issues in WebGL and Cast
  • This marks the seventh zero-day patched in Chrome during 2026, highlighting an unusually high vulnerability rate
  • Only 35 of the 230 vulnerabilities were reported by external researchers, with approximately $23,000 in bug bounty rewards distributed

Why It Matters

Chrome's vulnerability count for 2026 is exceptionally high, signaling potential systemic issues in the browser's codebase or increasing attack surface as web technologies grow more complex. For AI practitioners and security professionals, this underscores the importance of keeping browsers updated, especially given that V8 engine flaws can be weaponized to execute arbitrary code through malicious web pages—a common attack vector in AI-driven phishing and supply chain compromise scenarios.

Technical Details

  • CVE-2026-87491: Medium-severity out-of-bounds write in the V8 JavaScript and WebAssembly engine, actively exploited in the wild; reported by Jihyeon Jeong of Compsec Lab, Seoul National University
  • Critical vulnerabilities: Five critical bugs patched, including four in WebGL (use-after-free, out-of-bounds write, buffer overflow) and one use-after-free in Cast
  • High-severity defects: 41 high-severity issues resolved, spanning use-after-free, out-of-bounds read, incorrect/missing authorization, and race conditions
  • Medium/low-severity bugs: Over 180 medium- and low-severity vulnerabilities patched, including information leaks, UI misrepresentation, clickjacking, improper validation, and uninitialized resources
  • Chrome 153 versions: 153.0.8010.36/.37 for Windows and macOS; 153.0.8010.36 for Linux

Industry Insight

  • The seven zero-days in a single year suggest Chrome's attack surface is expanding faster than its security remediation pipeline can keep pace, warranting closer scrutiny of browser security engineering practices across the industry
  • Organizations should enforce automatic browser updates and consider endpoint detection and response (EDR) tools capable of identifying exploitation attempts targeting V8 engine vulnerabilities
  • The low ratio of external to internal bug reports (35 external vs. 230 total) indicates Google's internal security testing is catching the majority of issues, but also highlights the value of continued bug bounty investment to broaden the researcher community

TL;DR

  • Google Chrome 153正式发布,一次性修复230个安全漏洞,包含一个已在野外被利用的零日漏洞
  • 零日漏洞CVE-2026-87491位于V8 JavaScript/WebAssembly引擎,属于越界写入缺陷,由首尔大学Compsec Lab研究员发现
  • 2026年Chrome已修复第7个零日漏洞,另有5个关键漏洞(WebGL/Cast模块)和41个高危漏洞
  • 漏洞类型涵盖use-after-free、缓冲区溢出、竞态条件、授权缺失等,超过180个为中低危漏洞
  • Google仅支付35个外部报告漏洞约23,000美元赏金,建议用户立即更新至153.0.8010.36/.37版本

为什么值得看

Chrome作为全球使用最广泛的浏览器,其安全动态直接影响AI应用部署的Web端风险。2026年已出现7个零日漏洞,反映出浏览器引擎复杂度带来的持续安全挑战,对依赖Web技术的AI产品构成潜在威胁。

技术解析

  • 零日漏洞详情:CVE-2026-87491为中等严重性,位于V8引擎的JavaScript和WebAssembly执行路径中,属于越界写入(out-of-bounds write)问题,攻击者可利用其实现任意代码执行
  • 关键漏洞分布:5个关键漏洞集中在WebGL(图形渲染)和Cast(投屏)模块,主要为use-after-free、越界写入和缓冲区溢出,均可能导致远程代码执行
  • 高危漏洞类型:41个高危漏洞涵盖use-after-free、越界读取、授权缺失和竞态条件,涉及浏览器核心组件
  • 中低危漏洞:180+个漏洞包括信息泄露、UI欺骗、点击劫持、未初始化资源等,虽不直接导致RCE但可辅助攻击链
  • 漏洞来源:230个漏洞中仅35个(约15%)来自外部研究员,其余由Google内部安全团队发现

行业启示

  • WebAssembly安全需重视:V8引擎漏洞频发表明WebAssembly作为AI模型部署载体,其底层安全直接影响AI应用可靠性,开发者应关注引擎更新并及时迁移
  • 浏览器安全投入与漏洞产出不成正比:2026年已修复7个零日漏洞,反映复杂软件系统的固有安全挑战,企业需建立自动化更新机制和漏洞响应SOP
  • 外部白帽贡献有限:仅15%漏洞来自外部报告,说明内部安全研究能力更为关键,企业应平衡赏金计划与内部红队建设

Disclaimer: The above content is generated by AI and is for reference only. 免责声明:以上内容由 AI 生成,仅供参考。

Security 安全