Chrome 153: Google Patches 230 Vulnerabilities, Including an Actively Exploited Zero-Day in V8

Google has rolled out the stable build of the Chrome 153 browser, which closes 230 security vulnerabilities at once, five of which developers classified as critical. One of the flaws deserves particular attention: according to the company's own confirmation, an active exploit for it already exists in the wild, meaning the vulnerability is being used in real-world attacks. The update is being rolled out in stages, and its application is tied to a full restart of the application, which makes correctly installing the patch a separate task for the user.

What Was Fixed and Where the Main Threat Lies

The most dangerous flaw, according to the developers, is an out-of-bounds write error identified as CVE-2026-87491. It was found in the V8 engine, which handles JavaScript and WebAssembly. To execute arbitrary code inside the sandbox, an attacker only needs to get the victim to open a specially crafted HTML page, which makes the attack potentially mass-scale and does not require installing any malware. The five critical vulnerabilities relate to other components: four of them (CVE-2026-87464, CVE-2026-87488, CVE-2026-87438, and CVE-2026-87527) were found in the WebGL 3D graphics processing interface, and the fifth (CVE-2026-872) — in the Cast module that streams content to televisions.

The Seventh Zero-Day of the Year and the Role of Automation

This is already the seventh zero-day bug in Chrome actively used by hackers in 2026: the previous type-confusion flaw in V8 under code CVE-2026-85046 was patched just five days before the current release. The CVE-2026-87491 bug was reported in August by researcher Jiheon Jeong from the Compsec laboratory at Seoul National University, who received a reward of $2,500. Notably, in its list of acknowledgments, Google for the first time named automated bug-finding systems — Big Sleep, and one of the reports was submitted by the OpenAI Codex Security tool, indicating the growing role of AI tools in the hunt for vulnerabilities.

Contradictory Data

There is a notable discrepancy here between the official assessment and the real threat picture. Google formally rates the severity of CVE-2026-87491 as medium, for which the researcher received a relatively modest $2,500. At the same time, it is precisely this flaw that the developers call the most dangerous and confirm is being actively exploited in the wild — meaning the actual threat to users is incomparably higher than what is reflected in the standard severity rating. The second inconsistency concerns the perception of the update: the “Chrome updated” label in settings does not guarantee protection if the browser was left open with dozens of tabs, because the patch is applied only after the application is fully closed and restarted. Thus, “updated” in the interface and “protected” in fact are not the same thing.

How to Verify Protection and Apply the Patch

Since the V8 engine is part of the open-source Chromium project, the vulnerability affects almost all popular browsers except Firefox and Safari. Microsoft Edge, Brave, Opera, Vivaldi, and Samsung Internet release fixes on their own schedule, so users of these programs should separately check for updates. To check the status in Chrome, go to chrome://settings/help: the application will automatically check for and download fixes. If a “Relaunch” button appears after the download, be sure to click it — this action is what completes the installation of the security patch. If the page shows version 152 and nothing happens, the device has not yet entered the staged rollout queue, and the check should be repeated later.

New Release Schedule

Starting with version 153, Google is changing the release frequency: beta and stable versions for Windows, macOS, Linux, Android, and iOS will now be released every two weeks instead of the previous four. This will speed up the delivery of fixes, but at the same time raise the demands on user discipline — with more frequent updates, the risk of remaining on an unpatched version between releases grows, and the dependence of protection on a manual browser restart persists.