Google shipped Chrome 153 to the stable channel on 8 September with 230 security fixes, and it says attackers are already using one of them. In its release announcement, the Chrome team wrote that Google "is aware that an exploit for CVE-2026-87491 exists in the wild". CISA added that flaw to its Known Exploited Vulnerabilities catalog the next day, which puts a federal patching deadline on it.
The interesting part is which bug it turned out to be.
Attackers reached for the one rated Medium
CVE-2026-87491 is an out of bounds write in V8, the engine that runs JavaScript inside Chrome. An out of bounds write means code can put data into a part of memory it was never meant to touch, which is the usual first step in taking over a program. Hong Kong's HKCERT, which issued a bulletin on the release, says a remote attacker can use it to run arbitrary code inside the browser's sandbox by way of a crafted web page. The sandbox is the wall Chrome keeps between a web page and the rest of your computer, so code that lands inside it has not yet reached the machine itself.
Google's own rating for the flaw is Medium. It paid a $2,500 bounty and credits Jihyeon Jeong of the Compsec Lab at Seoul National University, listed as a research intern, who reported it on 6 August.
Five criticals, and none of them is the problem
Chrome 153's fix list breaks down as 5 critical bugs, 41 high, 133 medium and 51 low. Four of the five criticals sit in WebGL, the component that draws 3D graphics in the browser. Not one of them is the flaw under attack. Severity ratings describe how bad a bug could be at its worst, not how convenient it is to somebody building a working exploit, and this release is a clean illustration of the difference.
It is also the second Chrome flaw known to be exploited in under a week. On 4 September Google patched a different one in the 152 line, which IntelFusions covered at the time. CVE-2026-87491 reached the CISA catalog in the same batch as the Cisco firewall management flaw that three separate intrusion groups were already using.
Update to 153.0.8010.36, then actually restart
The patched builds are Chrome 153.0.8010.36 on Linux and 153.0.8010.36 or .37 on Windows and macOS. Google says the release "will roll out over the coming days/weeks", so it will not land on every machine at once, and checking manually under Help and then About Google Chrome pulls it forward. Downloading it is not the part that protects you. Chrome only swaps in the patched code when the browser is relaunched, so a session that has been open for a fortnight is still running the vulnerable build.
Browsers are the one piece of attack surface almost every organization has, on almost every device, facing content nobody controls. That is why a mid-rated memory bug in a JavaScript engine ends up carrying a government deadline.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.