If Chrome has been nagging you to restart, now's a good time to listen.
Also Read: How QR Codes Became the Web's Favorite On-Ramp - News
Google released Chrome 153 on Tuesday with a whopping 230 security fixes. One of them, CVE-2026-87491, is already being exploited in the wild. That makes it the seventh Chrome zero-day patched this year, and the second in less than a week.
What's the bug?
It's an out-of-bounds write in V8, the engine Chrome uses to run JavaScript and WebAssembly. In plain terms, a malicious web page could trigger it and run code inside Chrome's sandboxed renderer. On its own that's contained, but attackers rarely rely on a single bug. Chain it with a sandbox escape and you've got a full compromise.
Interestingly, Google rated it "Medium" on its own severity scale, based on what it can do in isolation. The fact that it's being actively exploited suggests somebody out there is using it as one link in a longer chain.
Also Read: Apple Finally Folds: iPhone Duo, iPhone 18 Pro and More Headline "Surprise and Shine"
As usual, Google isn't saying who's behind the attacks or who's being targeted. The flaw was reported on Sunday by Jihyeon Jeong, a research intern at Seoul National University's Compsec Lab, who picked up a $2,500 bounty for it. Going from report to patch in two days is quick, even by Google's standards.
Also Read: Laravel: Commentify Pro: Headless
Last week's zero-day, too
This comes hot on the heels of CVE-2026-85046, a type confusion bug that was also in V8, which Google fixed in Chrome 152 on September 3. The US Cybersecurity and Infrastructure Security Agency (CISA) has added both flaws to its Known Exploited Vulnerabilities catalogue, giving federal agencies until September 18 and September 23 respectively to patch.
Four of this year's seven Chrome zero-days have been in V8, and that isn't a coincidence. V8 is where Chrome runs untrusted code from the web, and its just-in-time compiler creates a class of bugs that even memory-safe approaches like Rust can't fully stamp out. Google's main defence has been the V8 Sandbox, an extra layer of isolation that's been switched on since Chrome 123 and forces attackers to find a second bug before they can break out.
Also Read: A Self-Hosted Disqus News Alternative for Laravel
What you should do
Open Chrome, go to Settings, then About Chrome, let it update to version 153, and restart. The restart is the step everyone forgets, and the patch doesn't actually kick in until you do it.
Also Read: Nvidia Under DOJ Scrutiny Over Groq Deal
Using Edge, Brave, Opera or Vivaldi instead? They're all built on Chromium, so they share the same V8 bugs until each vendor ships its own fix. Check for updates there too.
For developers and IT teams managing lots of machines, it's worth double-checking that auto-updates aren't being held back by a policy somewhere. Seven zero-days by early September puts 2026 on a busy pace, and there's no real reason to think we've seen the last of them.
