In short: On September 9, 2026, Google released Chrome 153, patching CVE-2026-87491 — the seventh actively exploited zero-day in the browser this year. An out-of-bounds write flaw in Chrome's V8 JavaScript engine lets a remote attacker execute arbitrary code inside the browser sandbox simply by directing a victim to a crafted HTML page. The fix is live in the Chrome 153 stable channel; make sure your browser has updated to 153.0.8010.36 or later.
What happened: Chrome's seventh zero-day of 2026
On September 9, 2026, Google released Chrome 153.0.8010.36 for Windows and Linux, and 153.0.8010.37 for macOS — an out-of-band update primarily aimed at closing CVE-2026-87491. This is the seventh actively exploited zero-day Google has patched in Chrome in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, and CVE-2026-85046 (the sixth, patched September 4, 2026).
Security researcher Jihyeon Jeong of the Compsec Lab at Seoul National University reported the flaw on August 6, 2026 — 34 days before the patch shipped. Google rated it Medium severity and awarded a $2,500 bug bounty. Google has confirmed active in-the-wild exploitation prior to the patch, but has not disclosed details about specific attack campaigns or targets — standard practice to limit copycat attacks while users update. We covered the previous V8 zero-day in our article on the sixth Chrome zero-day.
The technical flaw: out-of-bounds write in V8
V8 is the JavaScript and WebAssembly engine embedded in Chrome — it executes all JavaScript code on every page you visit. Out-of-bounds write is a class of memory safety bug where a program writes data beyond the end of an allocated buffer. Depending on what resides adjacent in memory, this can overwrite critical data structures and lead to arbitrary code execution.
In CVE-2026-87491, the bug lives in V8's JavaScript code processing. When Chrome loads a specially crafted HTML page, V8 executes malicious JavaScript that triggers the out-of-bounds write. The result: the attacker can run arbitrary code inside the renderer process — the sandboxed process that handles the browser tab. No user action beyond opening the page is required.
The key distinction from the sixth zero-day: CVE-2026-85046 was a type confusion flaw, while CVE-2026-87491 is an out-of-bounds write. Both classes allow code execution, but the mechanics differ. Type confusion misidentifies an object's type in memory; out-of-bounds write exceeds an allocated buffer boundary. Both are actively targeted by exploit authors because V8 is the most complex and most-attacked component of Chrome.
Who is affected and what to do right now
All Chrome versions below 153.0.8010.36 on Windows and Linux, and below 153.0.8010.37 on macOS, are vulnerable. Chrome on Android is also affected. Chrome on iOS is not affected — Apple requires all browsers to use the WebKit rendering engine rather than V8. Users of Chromium-based browsers (Brave, Microsoft Edge, Opera, and others) should await patches from their respective vendors; the CVE is shared, and patches will propagate.
How to verify and update Chrome:
- Open Chrome and click the three-dot menu (⋮) in the top-right corner.
- Go to Help → About Google Chrome.
- Chrome will automatically check for and begin downloading any available update.
- Click "Relaunch" when prompted — the patch only takes effect after a restart.
On Android, update through the Google Play Store. Enterprise environments with locked auto-updates should escalate immediately: this threat is active right now. For a deeper look at how browser zero-days fit into the broader privacy threat landscape — and how a VPN complements rather than replaces browser updates — visit the LiMP VPN privacy blog.
Seven zero-days in nine months: reading the trend
Seven actively exploited zero-days in under nine months of 2026 is a meaningful rate. For context: Google patched eight zero-days across all of 2023, and ten in 2024. The browser remains the primary attack surface not by chance: banking, corporate portals, email, and web-based messaging all flow through it.
The exploitation window was 34 days — from the August 6 report to the September 9 patch. During that month, real attacks were already happening, as Google confirmed. The pattern is typical for engine-level zero-days: a researcher finds and reports the flaw; Google works to reproduce and patch it; meanwhile, someone else — often an exploit broker — may be using the same vulnerability against real targets.
The practical takeaway is unchanged: Chrome auto-updates must be enabled. Not optional — mandatory. LiMP VPN encrypts traffic between your device and the internet: it does not patch browser engine vulnerabilities — only the browser update does that — but it protects against network-level interception, hides your IP from sites and your ISP, and blocks DNS spoofing. See LiMP VPN features and pricing plans — two different, complementary layers of protection.
Sources
- Anti-Malware.ru — Update Chrome: hackers are already exploiting the new 0-day vulnerability (09.09.2026)
- Help Net Security — Google fixes yet another actively exploited Chrome zero-day CVE-2026-87491 (09.09.2026)
- SecurityWeek — Chrome 153 Patches Seventh Zero-Day of 2026 (09.09.2026)
- BleepingComputer — Google patches seventh Chrome zero-day (09.09.2026)