Chrome's second zero-day in five days: fix the cadence
Chrome zero-day CVE-2026-87491 is an out-of-bounds write in V8, exploited in the wild. Update to 153.0.8010.36. The real problem is two emergency patches in five days.
Chrome zero-day CVE-2026-87491 is being exploited in the wild, and Google pushed the fix into the stable desktop channel this week — five days after the last emergency Chrome patch. Help Net Security reported it on September 9. If you patched Chrome last Friday and considered the job done, you are already behind again. That is the actual story here, not the bug.
What actually happened
CVE-2026-87491 is an out-of-bounds write in V8, Chrome's JavaScript and WebAssembly engine. Google rated it medium severity, which is the detail people will misread. Severity scores model the bug in isolation; "an exploit exists in the wild" describes reality. A crafted HTML page lets a remote attacker run code inside Chrome's sandbox — same shape as CVE-2026-85046, which Google patched on September 4.
The fix is in Chrome 153.0.8010.36 and .37 on Windows and macOS, and 153.0.8010.36 on Linux. Jihyeon Jeong of the Compsec Lab at Seoul National University reported the flaw on August 6 and collected a $2,500 bounty. SecurityWeek counts it as the seventh actively exploited Chrome zero-day of 2026.
Two emergency browser patches inside one week is the number to plan around. Google is now finding and shipping these faster than most small teams run a maintenance window.
Why it matters for your business
Monthly patch windows are a calendar artifact. They exist because someone once decided the first Tuesday was convenient. Nothing about the threat schedule agrees, and browsers in particular have moved to a rhythm that a monthly cycle cannot cover — you would have carried CVE-2026-85046 for weeks and never learned that 87491 replaced it.
The fix is not more diligence. It is removing the human from the loop. Chrome only applies updates on relaunch, so set an enforced relaunch deadline through Chrome Enterprise policy (BrowserRelaunchNotificationPeriod plus RelaunchNotification) and let the browser force the restart itself. Then verify: pull the reported version from every endpoint on a schedule and alert on anything below 153.0.8010.36. Verification is the part teams skip, and it is the only part that proves anything.
Extend the same check to Edge, Brave and Opera, and to every Electron app on the fleet. Those ship their own embedded Chromium, they do not follow Chrome's update channel, and nobody ever relaunches them.
Key takeaways
- CVE-2026-87491 is an out-of-bounds write in Chrome's V8 engine, confirmed exploited in the wild
- Fixed in Chrome 153.0.8010.36/.37 (Windows, macOS) and 153.0.8010.36 (Linux)
- Second actively exploited Chrome zero-day in five days; seventh of 2026
- Google rated it medium severity — an in-the-wild exploit outranks the score
- Force relaunch through enterprise policy instead of asking people to restart
- Verify reported versions on a schedule, and include Edge, Brave and Electron apps
If your patch window is monthly and your browser vendor is shipping weekly, the window is the vulnerability. We build the version-check automations that watch a fleet continuously and tell you which machines are behind — no dashboard to remember to open. See what we automate, or tell us what you are still patching by hand.
Sources: Help Net Security, SecurityWeek, Chrome Releases.
- #chrome
- #zero-day
- #patch-management
- #browser-security
- #vulnerability
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Attackers built and ran an agent campaign in six hours
Google's threat team watched an intruder plan, build and execute mass credential harvesting in under six hours using an agent framework. Your response window just shrank.
Read itcPanel CVE-2026-67401: a mail account becomes root
A SQL injection in cPanel's Email Track lets an authenticated account with mail privileges write files and execute code as root. Patched builds are out — check yours.
Read it