Grade One Press

Technology reporting you can check

News · Security & privacy

Chrome had two flaws exploited by attackers within a week; update to version 153 fixes the second

Both were in V8, Chrome's JavaScript engine, and let a crafted web page run code inside the browser's sandbox. Chrome 153 also fixed 229 other security bugs.

Catching up: the original came out on . This story was published later, when the site opened.

Grade One Newsroom · 1 min read

Sources: 3 · top grade 1How evidence is graded

Two Chrome flaws were exploited in a week; version 153 fixes the second

Grade 1 · Primary

Source: US Cybersecurity and Infrastructure Security Agency (CISA)

What changed
Google fixed a second exploited Chrome flaw in a week in Chrome 153 on 8 September; CISA listed it as exploited on 9 September.
Who it affects
People using Chrome and other Chromium-based browsers, such as Microsoft Edge, on versions older than the fixed releases.
What it does not tell you
Who was attacked, or how. Google says only that exploits exist in the wild, and keeps bug details restricted until most users are updated.

The full story Check the source

Google released Chrome 153 on 8 September with a fix for CVE-2026-87491, a flaw it said was being exploited, and the US Cybersecurity and Infrastructure Security Agency listed it as exploited on 9 September [1][3].

It was the second such Chrome flaw in a week. On 3 September Google had fixed CVE-2026-85046, also exploited, which CISA listed on 4 September [2][3].

Both are in V8, Chrome's JavaScript engine, and let a remote attacker run code inside the browser's sandbox through a crafted web page, according to CISA [3].

What it covers

Chrome on Windows, Mac and Linux. The fixes are in version 152.0.7977.82 and later for the first flaw, and 153.0.8010.36 and later for the second [1][2].

CISA notes that the flaws could affect other browsers built on Chromium, including Microsoft Edge [3].

Chrome 153 included 230 security fixes in all [1].

What it does not tell you

Who used the exploits, or against whom. Google says only that it is "aware that an exploit … exists in the wild" [1][2].

Google keeps bug details restricted until most users have the fix [1].

Sources and their grades

  1. Google Chrome Releases, Stable Channel Update for Desktop, 8 September 2026 (Chrome 153). Read 29 September 2026. Grade 3 · Filed record Google's own release notes.
  2. Google Chrome Releases, Stable Channel Update for Desktop, 3 September 2026. Read 29 September 2026. Grade 3 · Filed record Google's own release notes.
  3. US Cybersecurity and Infrastructure Security Agency (CISA), Known Exploited Vulnerabilities Catalog, entries CVE-2026-85046 and CVE-2026-87491. Read 29 September 2026. Grade 1 · Primary Added 4 and 9 September 2026.

A grade says how much weight a source will take, from 1 (a body that can compel an answer and has nothing to sell) to 5 (somebody describing what they sell, or themselves). The standard sets out what each grade may be used for.

Filed under Browsers Vulnerabilities

Comments

Commenting needs an account, made with nothing but an email address. A first comment is read before it appears.

More news

See all