Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day

Live updates

1. 24d ago

   Google Patches Actively Exploited Chrome V8 Zero-Day in September Update

   Google released a Chrome security update on September 29, patching an actively exploited V8 zero-day vulnerability. This update is part of Google's efforts to address multiple zero-day flaws in Chrome this year. The company has shifted to a faster two-week stable release cycle globally. Users of Chrome on Windows, Android, and iOS must update their software to mitigate targeted attacks and critical vulnerabilities.

   Why it matters

   The update is crucial as threat actors have been exploiting zero-day vulnerabilities in Chrome, including a V8 out-of-bounds flaw being chained with a sandbox escape to achieve OS code execution. Google has patched several zero-day vulnerabilities in Chrome this year, including CVE-2026-87491, an out-of-bounds write in the V8 engine. The company's faster release cycle aims to provide users with timely security patches.

   What is confirmed

   • Google patched CVE-2026-87491, an out-of-bounds write in the V8 engine, the seventh actively exploited Chrome zero-day of 2026.
   • Google patched CVE-2026-11645, a V8 out-of-bounds flaw being chained with a sandbox escape to achieve OS code execution, the fifth Chrome zero-day of 2026.
   • China-linked threat actors have been caught chaining two Google Chrome flaws with a Windows kernel vulnerability to compromise selected targets.
   • Google addresses 21 vulnerabilities, including a zero-day in Chrome's Dawn component.
   • Google released a Chrome Stable update fixing 32 vulnerabilities, including one critical and multiple high-severity flaws.

   Still unconfirmed

   • China-linked hackers deploy chained Chrome-Windows zero-day exploits

   What to watch next

   • Further updates from Google on Chrome vulnerabilities
   • CISA's response to the exploited vulnerabilities
   • Details on the threat actors involved in chaining Chrome and Windows zero-day exploits
   Sources used for this update (5)

   1. dailysecurityreview.com — Google Patches Seventh Chrome Zero-Day of 2026, CVE-2026 ...
   2. dailysecurityreview.com — Google Patches 5th Chrome Zero-Day; V8 Flaw Chains for OS ...
   3. thearabianpost.com — China-linked hackers deploy chained Chrome-Windows zero-day ...
   4. dailysecurityreview.com — Google Patches Exploited Zero-Day Among 21 Chrome ...
   5. cybersecuritynews.com — Google Releases Chrome Update With 32 Security Fixes for ...
   confidence 85%
2. 30d ago

   CISA Orders Rapid Patching of Pixel Zero-Day as Chrome Update Fixes 108 Flaws

   CISA has added the Pixel modem zero-day vulnerability CVE-2026-58704 to its Known Exploited Vulnerabilities catalog, giving agencies three days to apply the patch. Google also released Chrome 154, which resolves 108 security flaws, including 11 critical bugs. This browser update coincides with Google shifting to a faster two-week stable release cycle globally. Users of Pixel devices and Chrome on Windows, Android, and iOS must update their software immediately to mitigate targeted attacks and critical vulnerabilities.

   Why it matters

   Zero-day vulnerabilities are flaws unknown to the vendor until they are exploited in the wild. The inclusion of a flaw in the CISA KEV list signals a verified threat to federal infrastructure. Google is accelerating its browser update frequency to reduce the window of exposure for such bugs.

   What is confirmed

   • CISA added CVE-2026-58704 to the Known Exploited Vulnerabilities catalog.
   • Google released Chrome 154 to fix 108 security flaws, including 11 critical bugs.
   • Google is implementing a two-week stable browser release cadence worldwide.
   • The Pixel modem zero-day was used in targeted attacks.

   What to watch next

   • Reports of wider exploitation of the Pixel modem flaw beyond limited targeted attacks
   • CISA updates on agency compliance with the three-day patching deadline
   Sources used for this update (2)

   1. www.techrepublic.com — CISA Gives Agencies 3 Days to Patch Exploited Pixel Zero-Day
   2. lapaasvoice.com — Chrome 154 Security Update Fixes 108 Flaws
   confidence 100%
3. 37d ago

   Google patches Pixel modem zero-day and 42 Chrome security flaws

   Google has released September 2026 security updates to fix a high-severity zero-day vulnerability affecting Pixel device modems. The company confirmed the flaw was used in targeted attacks against a limited number of phones. Simultaneously, Google is updating Chrome for Windows, Android, and iOS to resolve 42 security vulnerabilities, some of which are classified as critical. Users should install the Pixel Update Bulletin and relaunch Chrome to secure their systems against these active and potential threats.

   Why it matters

   These updates follow the discovery of the BlueMoon exploit kit, which targeted government and defense entities. The combination of browser and hardware-level modem flaws increases the risk of sophisticated espionage campaigns.

   What is confirmed

   • Google released September 2026 security patches for Pixel devices to address 110 vulnerabilities.
   • A zero-day vulnerability related to the Pixel modem was actively exploited in targeted attacks.
   • Google is fixing 42 security flaws in Chrome across Windows, Android, and iOS versions.
   • Some of the Chrome vulnerabilities are classified as critical.

   What to watch next

   • Identification of the specific threat actors targeting Pixel modems
   • Release of technical details regarding the 42 Chrome vulnerabilities
   • Confirmation of whether the Pixel modem flaw is linked to the BlueMoon exploit kit
   Sources used for this update (6)

   1. www.bleepingcomputer.com — Google fixes actively exploited Android zero-day on Pixel devices
   2. www.pcworld.com — Google just fixed 42 Chrome security flaws. Update now
   3. www.androidpolice.com — Google confirms a dangerous Pixel security flaw was exploited by hackers
   4. 9to5google.com — Google confirms Pixel phones were exploited in ‘targeted’ attack related to modem
   5. securityaffairs.com — Google Patches Pixel Modem Zero-Day Exploited in Targeted Attacks
   6. cybersecuritynews.com — Android 0-day Vulnerability on Google Pixel Devices Actively Exploited in Attacks
   confidence 100%
4. 40d ago

   Google Issues Urgent Chrome Update to Patch Exploited V8 Zero-Day

   Google released Chrome version 153 to fix an actively exploited V8 JavaScript engine zero-day vulnerability tracked as CVE-2026-87491. Users must update their browsers immediately and relaunch the software to ensure old processes are replaced and system compromises are blocked. Espionage-motivated threat actors deployed the BlueMoon exploit kit, chaining browser and Windows flaws to target government, defense, and commercial entities worldwide. Four nation-state groups used the same attack code within a twelve-day window, prompting heightened security alerts across enterprise environments amid accelerating global cyberattacks.

   Why it matters

   Active exploitation of browser vulnerabilities poses a direct risk to enterprise infrastructure and government systems due to potential arbitrary code execution. The rapid adoption of the BlueMoon kit by multiple hacking crews underscores the speed at which threat actors weaponize unpatched flaws. Users need to navigate to the about settings page in Chrome to apply version 153 and complete a restart to secure their devices.

   What is confirmed

   • Google issued Chrome version 153 to fix a critical V8 JavaScript engine zero-day vulnerability tracked as CVE-2026-87491.
   • Espionage-motivated threat actors deployed an exploit kit known as BlueMoon that chains browser and Windows vulnerabilities to target entities worldwide.
   • Four nation-state groups used the same exploit kit within a twelve-day window.
   • Users must update their browsers to version 153 and perform a relaunch so that old processes do not remain active.

   What to watch next

   • Confirmation of additional patches or emergency updates from Microsoft regarding the chained Windows vulnerabilities.
   • Reports of further threat actor groups adopting the BlueMoon exploit kit.
   Sources used for this update (4)

   1. digital-magazin.de — Chrome Update: 230 Fixes, Zero-Day – Relaunch entscheidet
   2. www.techrepublic.com — AI Agents, Foldables, Cyberthreats, and Chip Deals Define This Week in Tech
   3. cryptonews.net — BlueMoon exploit kit spreads to four hacking groups within days
   4. cybersecuritynews.com — Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories
   confidence 100%
5. 44d ago

   Google Patches Seventh Chrome Zero-Day Exploited by Nation-States

   Google has issued Chrome version 153 for desktop and Android platforms to fix a critical V8 JavaScript engine zero-day vulnerability tracked as CVE-2026-87491. Espionage-motivated threat actors deployed an exploit kit known as BlueMoon that chains this browser flaw with a Windows vulnerability to target government, defense, and commercial entities worldwide. Researchers discovered that four nation-state groups used the same exploit kit within a 12-day window. Users need to update their browsers immediately to version 153.0.8010.36 on Linux and versions 153.0.8010.36 or 153.0.8010.37 on Windows and Mac to block potential arbitrary code execution and system compromise.

   Why it matters

   This security update addresses the seventh zero-day flaw patched by Google since the start of the year. The rapid adoption of the BlueMoon exploit kit by multiple state-backed actors highlights the speed at which attackers weaponize newly discovered browser and operating system vulnerabilities to deploy backdoors and surveillance tools.

   What is confirmed

   • Google released Chrome version 153 to address a V8 zero-day flaw actively targeted in attacks.
   • Espionage-motivated threat actors used the BlueMoon exploit kit to chain Chrome and Windows zero-days.
   • Targets of the exploit kit include government, defense, and commercial entities worldwide.

   Still unconfirmed

   • Researchers suspect artificial intelligence development was involved in the creation of the BlueMoon exploit kit.

   What to watch next

   • Additional technical details regarding the BlueMoon exploit kit mechanics
   • Further disclosures on the specific nation-state groups utilizing the zero-day chain
   Sources used for this update (4)

   1. securityaffairs.com — Four Nation-State Actors Used the Same Chrome Zero-Day Exploit Kit Within 12 Days
   2. cybersecuritynews.com — Hackers Chain Chrome and Windows Zero-Days in New BlueMoon Exploit Kit Attacks
   3. startupfortune.com — Google Patches Chrome's Seventh Zero-Day of 2026 in Just Two Days
   4. www.bitdefender.com — Google patches Chrome zero-day exploited by hackers – update now!
   confidence 95%
6. 45d ago

   Google Issues Chrome 153 Patch for Seventh Zero-Day Vulnerability

   Google has released Chrome version 153 to the stable channel for Windows, Mac, and Linux to address 230 security vulnerabilities. The update includes a fix for a V8 JavaScript engine zero-day flaw that is actively targeted in attacks. This represents the seventh exploited zero-day vulnerability patched by Google since the start of the year. Users must update their browsers immediately to version 153.0.8010.36 on Linux and versions 153.0.8010.36 or 153.0.8010.37 on Windows and Mac to prevent potential arbitrary code execution and system compromise.

   Why it matters

   Active browser exploitation campaigns threaten users who visit malicious websites, making rapid software deployment critical for defense. The V8 engine vulnerability allows attackers to target foundational browser components that process JavaScript. Google continues to issue rapid security updates to address heavily targeted flaws in the stable channel.

   What is confirmed

   • Google has released Chrome 153 to the stable channel for Windows, Mac, and Linux.
   • The update fixes 230 vulnerabilities, including a zero-day flaw in the V8 JavaScript engine.
   • This security update addresses the seventh actively exploited Chrome zero-day patched since the start of the year.
   • The zero-day flaw is tracked under the identifier CVE-2026-87491.
   • The stable channel update ships as version 153.0.8010.36 on Linux and versions 153.0.8010.36 and 153.0.8010.37 on Windows and Mac.
   • The V8 bug could let attackers run arbitrary code.

   Still unconfirmed

   • The vulnerability is connected to threat actor groups utilizing specific campaign targets.

   What to watch next

   • Disclosures regarding the specific threat actors or campaign targets behind CVE-2026-87491
   • Additional technical analysis detailing how attackers bypass the browser sandbox using this V8 flaw
   • Adoption rates of Chrome 153 across the global user base
   Sources used for this update (7)

   1. www.bleepingcomputer.com — Google warns of new Chrome zero-day bug exploited in attacks
   2. cyberinsider.com — Google fixes second actively exploited Chrome zero-day in under five days
   3. www.securityweek.com — Chrome 153 Patches Seventh Zero-Day of 2026
   4. cybersecuritynews.com — Chrome 153 Fixes 230 Vulnerabilities, Including One 0-Day Exploited in the Wild
   5. www.mirror.co.uk — Urgent new warning for all Chrome users and why you must restart your browser now
   6. www.pcquest.com — Hackers are exploiting a new Chrome zero day and Google wants you patched now
   7. securityaffairs.com — Google fixes the seventh actively exploited Chrome zero-day of 2026
   confidence 95%
7. 46d ago

   CISA Adds Chromium V8 Type Confusion Zero-Day to Known Exploited Catalog

   CISA has added a critical Google Chromium V8 type confusion vulnerability, tracked as CVE-2026-85046, to its Known Exploited Vulnerabilities Catalog. This flaw is being actively used in attacks, prompting Google to release an urgent software update for Chrome. The patch addresses this zero-day alongside several other browser bugs. Users risk compromise by visiting malicious websites and should update their browsers immediately to mitigate the threat. Google has not identified the specific targets or the groups responsible for the attacks.

   Why it matters

   The V8 engine is the open-source JavaScript and WebAssembly engine used by Chrome and other Chromium-based browsers. Type confusion vulnerabilities can allow attackers to execute arbitrary code or bypass security boundaries. CISA inclusion in the KEV catalog mandates federal agencies to patch the flaw within specific timeframes.

   What is confirmed

   • The Google Chromium V8 type confusion vulnerability is tracked as CVE-2026-85046.
   • CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities Catalog.
   • The V8 vulnerability is being actively exploited in attacks.
   • Google released a software update to patch this zero-day and other browser bugs.

   What to watch next

   • Identification of the threat actors responsible for the V8 attacks
   • Disclosure of specific targets affected by the type confusion exploit
   Sources used for this update (6)

   1. thehackernews.com — The Hacker News | #1 Trusted Source for Cybersecurity News
   2. cybersecuritynews.com — Weekly Cybersecurity Newsletter Bulletin – CrowdStrike Falcon, Chrome 0-Day, GPT-6 Astra, Dropbox Breach and 20+ Stories
   3. securityaffairs.com — Your MikroTik Router May Already Be Compromised: Look for SSH User “-2”
   4. cybersecuritynews.com — CISA Warns of Chromium Type Confusion 0-Day Vulnerability Actively Exploited in Attacks
   5. www.bleepingcomputer.com — Latest Actively Exploited news
   6. securityaffairs.com — Security Affairs
   confidence 100%
8. 48d ago

   Google Issues Chrome Update to Fix Active V8 Zero-Day

   Google has released an urgent software update for Chrome to address a critical security flaw in the V8 engine that malicious actors are actively exploiting in the wild. Multiple security advisories warn that visiting malicious websites puts users at high risk from these critical browser vulnerabilities. Google has issued patches for multiple browser bugs alongside the zero-day exploit, prompting industry calls for users to update their browsers immediately. The company has not disclosed specific details regarding the targets or perpetrators of the active attacks.

   Why it matters

   Zero-day vulnerabilities in core browser components like the V8 JavaScript engine present immediate risks because attackers can execute arbitrary code before users realize an exploit is underway. Prompt patching by vendors like Google is vital to block ongoing attacks on unsuspecting web users. Security researchers track these exploits closely to understand evolving threat techniques.

   What is confirmed

   • Google has released a Chrome update to patch a zero-day vulnerability in the V8 engine that is under active exploitation.
   • Two critical Chrome flaws put users at risk on malicious websites.

   Still unconfirmed

   • Google has not revealed who is using the V8 zero-day exploit or whom they targeted.

   What to watch next

   • Google releasing additional technical details regarding the exploit targets or threat actor identity.
   • Further security advisories detailing the exact nature of the critical browser flaws.
   Sources used for this update (8)

   1. The Hacker News — Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day
   2. Malwarebytes — Two critical Chrome flaws put users at risk on malicious websites
   3. cybersecuritynews.com — Critical Chrome 0-Day Vulnerability Actively Exploited in the Wild
   4. tech.yahoo.com — Google patches multiple browser bugs including one that was under active exploitation — so update now
   5. Hong Kong Computer Emergency Response Team Coordination Centre — Google Chrome Multiple Vulnerabilities
   6. Forbes — Google Update For Actively Exploited Chrome Security Flaw Confirmed
   7. decrypt.co — Update Your Browser: Google Patches Chrome Flaw Hackers Were Already Using
   8. securityaffairs.com — Security Affairs newsletter Round 593 by Pierluigi Paganini – INTERNATIONAL EDITION
   confidence 100%