Google has released a major security update for Chrome that fixes 230 vulnerabilities. One of them is concerning because Google says it is already being exploited in the wild.
The vulnerability, tracked as CVE-2026-87491, affects V8, the JavaScript and WebAssembly engine used by Chrome. It is an out-of-bounds write flaw that can allow a remote attacker to execute arbitrary code inside Chrome’s sandbox by getting a user to open a specially crafted HTML page.
Google has not shared details about the ongoing attacks or who is behind them. The company says access to technical details will remain restricted until most users have installed the fix.
The vulnerability was discovered by security researcher Jihyeon Jeong of Compsec Lab at Seoul National University. Jeong reported the issue to Google on August 6, 2026, and received a $2,500 bug bounty.
What makes this update more notable is that CVE-2026-87491 is already the seventh actively exploited Chrome zero-day patched by Google this year.
The other exploited Chrome zero-days patched in 2026 include CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, and CVE-2026-85046.
The latest update also fixes five critical vulnerabilities affecting Chrome’s WebGL and Cast components. These include multiple use-after-free flaws, an out-of-bounds write, and a buffer overflow.
Google says it discovered and reported 195 of the 230 vulnerabilities fixed in this update. One high-severity use-after-free vulnerability in WebPackaging, tracked as CVE-2026-87639, was reported by OpenAI Codex Security.
Google says several of its security bugs are found using tools such as AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL.
Google has released Chrome version 153.0.8010.36/.37 for Windows and macOS, while Linux users should update to 153.0.8010.36.
Chrome users can check for the update by opening:
More > Help > About Google Chrome
Chrome will automatically check for the latest version. If an update is available, users can install it and relaunch the browser.
The same vulnerabilities can also affect other Chromium-based browsers. Users of Microsoft Edge, Brave, Opera, Vivaldi, and other Chromium-based browsers should install the corresponding security updates when they become available.
