Google has released Chrome 153—version 153.0.8010.36 for Linux and 153.0.8010.36/.37 for Windows and macOS. This rollout, delivered via the stable channel, includes a sweeping security update that patches 230 vulnerabilities, making it one of the biggest security sweeps in recent Chrome history.
Main Zero-Day and Critical Risks
The most concerning flaw, CVE-2026-87491, is a medium-severity out-of-bounds write vulnerability inside Chrome’s V8 JavaScript and WebAssembly engine. What makes it urgent is that it’s already being exploited in the wild. Although classified as “medium,” this sort of bug can be especially dangerous since V8 issues are often chained with sandbox escape vulnerabilities and used to execute code remotely.
The bug was discovered by Jihyeon Jeong at Seoul National University’s CompSec Lab, who earned a $2,500 bounty for reporting it. Beyond the zero-day, Chrome 153 addresses five other critical vulnerabilities, many connected to use-after-free or out-of-bounds write issues in the WebGL and Cast components. Notable among these are CVE-2026-87464, CVE-2026-87488, CVE-2026-87438, CVE-2026-87527, and CVE-2026-87628. Several were found by Google’s internal security team.
High, Medium, and Low Severity Fixes
In addition to critical and zero-day flaws, the update eliminates 43 high-severity bugs across ANGLE, PDFium, V8, Views, DevTools, Web Authentication, and Payments modules. Highlights include CVE-2026-87512 (ANGLE) and CVE-2026-87585 (PDFium), both of which also carried bounty rewards of up to $2,500. Several discoveries came from researchers using AI-assisted tools, including teams like OpenAI’s Codex Security.
The bulk of the fixes—141 medium-severity and 41 low-severity issues—cover areas such as incorrect or missing authorization, UI misrepresentation, information leaks, and other bugs across components including FileSystem, ServiceWorker, Extensions, Safe Browsing, and Payments. Among the larger bounty payouts were $5,000 for CVE-2026-87504 (use-after-free in Core) and $3,000 for CVE-2026-87640 in WebView, both awarded to the same researcher.
Why You Need to Update Now
With a zero-day already in exploitation, five critical bugs, and over 200 additional vulnerabilities addressed, this isn’t one of Chrome’s optional security updates—it’s mandatory for safety. Google notes that even though tools like AddressSanitizer, MemorySanitizer, and libFuzzer help catch many vulnerabilities during development, threat actors are still finding new attack vectors rapidly.
Users are strongly advised to update to build 153.0.8010.36 or later as soon as possible. The update is being pushed to devices over the coming days, but manual updating speeds up protection.
This update underscores just how relentless browser engine vulnerabilities have become, especially in components like V8, WebGL, and Cast. Chrome 153 is a wake-up call: even major browsers once thought “secure” still require constant vigilance, especially with AI tools heavily used in both finding and exploiting flaws. Watch to see how quickly enterprises roll out this patch; delays could open doors to widespread exploitation.
