Google released security updates to address 230 vulnerabilities impacting the Chrome browser. One of these vulnerabilities, tracked as CVE-2026-87491, is being exploited in the wild. This is an out-of-bounds write vulnerability in the V8 JavaScript engine. The vulnerability was discovered and reported by Jihyeon Jeong (Compsec Lab, Seoul National University /Research Intern).
CISA acknowledged the active exploitation of the vulnerability by adding it to its Known Exploited Vulnerabilities Catalog. CISA urges users to patch the vulnerability before September 23, 2026.
CVE-2026-87491 is the seventh zero-day vulnerability patched by Google since the start of the year. The list includes:
Affected Versions
The vulnerability affects Google Chrome versions before 153.0.8010.36.
Mitigation
Customers must upgrade to the Chrome stable channel version 153.0.8010.36 (Linux) 153.0.8010.36/.37 Windows/Mac.
For more information, please refer to the Google Chrome Release Page.
Microsoft has released the Microsoft Edge Stable Channel (Version 152.0.4191.66) to address CVE-2026-87491, which the Chromium team has reported as being exploited in the wild.
Qualys Detection
Qualys customers can scan their devices with QIDs 388666 and 388708 to detect vulnerable assets.
Rapid Response with TruRisk™ Eliminate
Qualys TruRisk Eliminate and its Zero-Touch Patching feature provide a seamless, automated process for patching vulnerabilities like this.
Zero-Touch Patching identifies the most vulnerable products in your environment and automates the deployment of necessary patches and configuration adjustments. This streamlines the patching process and ensures vulnerabilities are addressed promptly.
Please continue to follow Qualys Threat Protection for more coverage of the latest vulnerabilities.
References
https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html
