Google has patched 230 vulnerabilities in Chrome on Tuesday, including its seventh actively exploited zero-day of 2026. The latest flaw, CVE-2026-87491, is an out-of-bounds write weakness in Chrome’s V8 JavaScript and WebAssembly engine. A carefully crafted webpage can trigger the bug to execute arbitrary code inside Chrome’s sandbox, corrupt heap memory to expose sensitive data, or crash the browser — no download or user interaction beyond visiting a page is required. The flaw was reported by Jihyeon Jeong, a research intern at Seoul National University’s Compsec Lab, and Google confirmed it is already being exploited in real attacks. Details about the active exploits are being withheld until most users have received the fix.
The update — Chrome 153.0.8010.36 for Windows and Linux, 153.0.8010.37 for Mac — began rolling out immediately after the advisory was published. Google says it may take days or weeks to reach all users through automatic updates, but the patch was already available on Tuesday when BleepingComputer manually checked for updates. This is the seventh Chrome zero-day Google has patched this year: earlier exploited bugs in 2026 include CVE-2026-2441 (CSS font values), CVE-2026-3909 and CVE-2026-3910 (Skia and V8), CVE-2026-5281 (Dawn/WebGPU), and CVE-2026-85046 (V8 type confusion, covered 5 September).
How to check if you’re affected
Affected versions are any Chrome release before 153.0.8010.36 (Windows/Linux) or 153.0.8010.37 (Mac). Open Chrome, go to Settings → Help → About Google Chrome, wait for the browser to check for updates, then relaunch. The version number on that page confirms whether the patch is installed.