Google fixes second actively exploited Chrome zero-day in under five days

Google has released Chrome 153 to the stable channel with fixes for 230 security vulnerabilities, including a V8 memory corruption flaw that Google says is already being exploited in attacks.

The actively exploited vulnerability is tracked as CVE-2026-87491 and is described as an out-of-bounds write in V8, Chrome’s JavaScript and WebAssembly engine. It was reported to Google on August 6 by Jihyeon Jeong of the Compsec Lab at Seoul National University.

Despite assigning the flaw a medium-severity rating, Google warned in its bulletin that an exploit for CVE-2026-87491 exists in the wild.

An out-of-bounds write occurs when software writes data outside the memory region allocated to it. In a JavaScript engine such as V8, this type of memory corruption can potentially allow an attacker to alter adjacent memory structures and interfere with the browser process in unintended ways.

In a plausible web-based attack, exploitation could begin when a victim visits a malicious or compromised webpage containing specially crafted JavaScript designed to trigger the V8 flaw. Successful exploitation could provide an attacker with a memory-corruption primitive that may be used to execute code inside Chrome’s renderer process.

Google has not disclosed how CVE-2026-87491 is being exploited, what targets are being attacked, or whether the vulnerability is being chained with a second flaw to escape Chrome’s sandbox or gain broader access to the underlying operating system. The company is also restricting access to some bug details until a larger proportion of users have installed the update.

The fix comes only days after Google addressed another actively exploited V8 zero-day. On September 3, Google disclosed CVE-2026-85046, a high-severity type confusion vulnerability in V8 that was also being exploited in the wild.

With CVE-2026-87491 now patched in Chrome 153, this is the second Chrome zero-day Google has addressed in under five days, based on the timing of the two releases.

Chrome 153.0.8010.36 is rolling out for Linux, while Windows and macOS users are receiving versions 153.0.8010.36 and 153.0.8010.37. Google says it will deploy gradually over the coming days and weeks.

The release contains 230 security fixes overall, including five vulnerabilities rated critical.

Four of the critical issues affect WebGL: two use-after-free vulnerabilities tracked as CVE-2026-87464 and CVE-2026-87488, an out-of-bounds write tracked as CVE-2026-87438, and a buffer overflow tracked as CVE-2026-87527. A fifth critical vulnerability, CVE-2026-87628, is a use-after-free issue in Chrome’s Cast component.

The update also addresses numerous high-severity flaws across V8, ANGLE, WebGL, PDFium, DevTools, Web Authentication, Payments, Network, GPU-related components, and other parts of the browser. Several involve use-after-free conditions, buffer overflows, out-of-bounds memory access, type confusion, or authorization errors.

Chrome users should install the update as soon as it becomes available by opening Settings → About Chrome and allowing the browser to check for updates.