Google warns of new Chrome zero-day flaw exploited in attacks

Live updates

1. 7d ago

   Google Patches Seventh Chrome Zero-Day Vulnerability of 2026

   Google has pushed out Chrome 153 to fix 230 security flaws, which includes the seventh actively exploited zero-day vulnerability patched this year. The newly released stable channel update applies to Windows, Mac, and Linux systems. Cybersecurity authorities have flagged the underlying issue in the V8 engine as an active threat, adding the tracked identifier to catalog listings. Users are urged to apply the software updates immediately to protect against malicious attacks targeting the browser.

   Why it matters

   This release follows a rapid sequence of patches deployed by Google to address high-risk security flaws in the V8 JavaScript engine. The latest updates target vulnerabilities that put users at risk when browsing the web. Security agencies track these weaponized exploits closely to prevent wider network compromises.

   What is confirmed

   • Google has patched 230 vulnerabilities on Tuesday, including another actively exploited Chrome zero-day bug, the seventh such vulnerability patched since the start of the year.
   • Google has released Chrome 153 to the stable channel with fixes for 230 security vulnerabilities, including a zero-day flaw in the V8 engine.
   • Google has rolled out Chrome 153 to the stable channel for Windows, Mac, and Linux, shipping as version 153.0.8010.36 on Linux and 153.0.8010.36/.37 on Windows and Mac.

   Still unconfirmed

   • CISA has added a critical Google Chromium V8 type confusion vulnerability, tracked as CVE-2026-85046, to its Known Exploited Vulnerabilities Catalog, warning that the flaw is being actively exploited in attacks.

   What to watch next

   • Additional technical details regarding threat actor campaigns exploiting CVE-2026-87491 or CVE-2026-85046.
   • Further updates from CISA or security vendors tracking Chromium browser exploitation.
   Sources used for this update (5)

   1. cybersecuritynews.com — CISA Warns of Chromium Type Confusion 0-Day Vulnerability Actively Exploited in Attacks
   2. www.bleepingcomputer.com — Google warns of new Chrome zero-day bug exploited in attacks
   3. cyberinsider.com — Google fixes second actively exploited Chrome zero-day in under five days
   4. www.securityweek.com — Chrome 153 Patches Seventh Zero-Day of 2026
   5. cybersecuritynews.com — Chrome 153 Fixes 230 Vulnerabilities, Including One 0-Day Exploited in the Wild
   confidence 90%
2. 8d ago

   Google Patches Actively Exploited Chrome V8 Zero-Day

   Google has released a security update for Chrome to fix a V8 zero-day vulnerability that attackers were actively exploiting. The update addresses multiple browser bugs, including two critical flaws that placed users at risk when visiting malicious websites. Users are urged to update their browsers immediately to mitigate these risks. This patch is part of a broader series of updates addressing dozens of vulnerabilities across different web browsers.

   Why it matters

   Zero-day vulnerabilities are flaws unknown to the vendor until they are exploited by attackers. Because the V8 engine handles JavaScript execution, flaws in this component can often lead to remote code execution.

   What is confirmed

   • Google released a Chrome update to patch an actively exploited V8 zero-day vulnerability.
   • The security update addresses multiple browser bugs.
   • Two critical Chrome flaws put users at risk on malicious websites.

   What to watch next

   • Confirmation of the specific CVE identifier for the V8 flaw
   • Reports on the scale of the active exploitation attacks
   Sources used for this update (13)

   1. The Hacker News — Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day
   2. Malwarebytes — Two critical Chrome flaws put users at risk on malicious websites
   3. TechRadar — Google patches multiple browser bugs including one that was under active exploitation — so update now
   4. Forbes — Google Update For Actively Exploited Chrome Security Flaw Confirmed
   5. BleepingComputer — Google warns of new Chrome zero-day flaw exploited in attacks
   6. SecurityWeek — Chrome and Firefox Updates Patch Dozens of Vulnerabilities
   7. www.seroundtable.com — Daily Search Forum Recap: September 7, 2026
   8. thehackernews.com — ⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
   9. thehackernews.com — Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released
   10. www.bleepingcomputer.com — ConnectWise warns of new ScreenConnect flaw without patch
   11. www.securityweek.com — Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
   12. thecyberexpress.com — Attackers Exploit Unpatched Magento Zero-Day to Backdoor Online Stores
   confidence 100%