Chrome CVE-2026-87491: Update to 153.0.8010.36 — V8 Zero-Day Exploited in the Wild

On 8 September 2026 Google promoted Chrome 153 to the stable channel: 153.0.8010.36 on Linux, 153.0.8010.36 and .37 on Windows and Mac. The release carries 230 security fixes, but the reason to hurry is one of them — CVE-2026-87491.

It is an out-of-bounds write in V8, the JavaScript engine. A remote attacker only has to get you to open a crafted HTML page to run arbitrary code inside the renderer sandbox. And Google's own release notes state that it is aware an exploit for this flaw exists in the wild.

There is one thing to do: update Chrome, then restart it.

What to do right now

• ✓Update Chrome. Type `chrome://settings/help` into the address bar; opening that page starts the check and the download. You are patched once the version reads 153.0.8010.36 or later (on Windows and Mac, .37 also counts).
• ✓Press the Relaunch button. Downloading alone does nothing. Until Chrome actually restarts, the old V8 keeps running.
• ✓Update Edge too. CISA states the flaw "could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera." Check Edge at `edge://settings/help`.
• ✓Check Chrome on your phone. Android and iOS builds update through Google Play and the App Store on a different schedule from desktop.
• ✓If you manage company devices, consider forcing the update. CISA set 23 September 2026 as the remediation deadline for US federal agencies.

Where that score comes from. The 8.8 above is the CVSS v3.1 score assigned by CISA-ADP, with the vector `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`. The CVE's status in NVD is "Modified". As a separate fact, the record carries no NIST-assigned CVSS metric — the only CVSS score on it comes from CISA-ADP. "Modified" is a record-state label meaning the entry was amended; it does not itself mean NIST has not assessed the CVE.

Worth noting: Google's own severity rating for this bug is Medium. Two ratings sit side by side for the same flaw — 8.8 HIGH and Medium. Someone reading NVD will say it is HIGH; someone reading Google's release notes will say Medium. Both are right; they are citing different sources. This article takes the CISA-ADP number as the CVSS value and states Google's rating alongside it.

Why "Medium" still means hurry

A severity rating estimates how bad it would be *if* the flaw were exploited. Whether it is being exploited right now is separate information.

This CVE falls into the second category. Google closes its release notes with this line:

Chrome Releases, "Stable Channel Update for Desktop", 8 September 2026

  Google is aware that an exploit for CVE-2026-87491
  exists in the wild.

On 9 September 2026 CISA added it to the KEV (Known Exploited Vulnerabilities) catalog.

The urgency comes from those two facts, not from the number: Google acknowledges a working exploit, and CISA has logged it as actually exploited. "It's only Medium, so it can wait" does not survive either of them.

What actually happens: an out-of-bounds write in V8

V8 is the engine Chrome uses to run the JavaScript on a web page. It runs whenever you open a page, which is why simply rendering an attacker's page is enough to reach the bug.

An out-of-bounds write (CWE-787) means data is written past the end of the memory that was allocated for it. When an attacker controls where and what gets written, they can hijack the program's flow. Per NVD, the result here is that a remote attacker can execute arbitrary code inside the sandbox via a crafted HTML page.

Read "inside the sandbox" precisely. Chrome renders pages in an isolated process, so this flaw alone does not hand an attacker free rein over your operating system.

That is not the same as safe, though. Code running inside the sandbox opens the door to stealing data beyond the current page, and to being chained with a second flaw that escapes the sandbox. Neither inflate nor dismiss it — treat it as a hole that closes when you update, and close it today.

Chrome is not the only thing affected

CISA's KEV entry puts it plainly: "This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera."

V8 is part of Chromium, and Chromium is the foundation under many browsers. Do not stop after updating Chrome.

This article deliberately does not list fixed version numbers for browsers other than Chrome. Check each vendor's own update notice. A guessed version number would only create false confidence.

• ▸Google Chrome — `chrome://settings/help`. Fixed in 153.0.8010.36 (on Windows and Mac, .37 also applies)
• ▸Microsoft Edge — `edge://settings/help`. Chromium-based, so it is in scope; confirm the patched build in Microsoft's own advisory
• ▸Opera / Brave / Vivaldi and similar — all Chromium-based; check each vendor's update notice
• ▸Electron desktop apps — they bundle Chromium, so the app itself may need an update

Confirming the update landed

Opening `chrome://settings/help` runs the check and the install together. If the version shown is 153.0.8010.36 or later (.37 also counts on Windows and Mac), you are patched.

If the update never arrives, your organisation may be controlling rollout centrally. Raise it with whoever manages your devices, and cite the CISA deadline of 23 September 2026. On a personal machine that will not update, quit Chrome completely and reopen it.