Google is rolling out Chrome 153 for Windows, macOS and Linux with a fix for a vulnerability already being exploited. Desktop Chrome users should check for the update now, especially if they rarely restart the browser.
Chrome normally updates automatically, but leaving it open for long periods can delay completion. Restarting the browser applies a downloaded update.
That code initially runs inside Chrome’s sandbox, a security barrier designed to restrict access to the rest of the device. The flaw therefore does not mean the attacker automatically gains unrestricted control of the whole PC, but it can provide an important foothold.
Install the update
Malwarebytes Labs reports that the stable release is 153.0.8010.36 or .37 on Windows and Mac, and 153.0.8010.36 on Linux.Chrome normally updates automatically, but leaving it open for long periods can delay completion. Restarting the browser applies a downloaded update.
- Open the three-dot More menu, then select Settings > About Chrome.
- Let Chrome download any available update, then restart it.
- Return to About Chrome and confirm the version is 153.0.8010.36 or later.
What the exploited flaw can do
Tracked as CVE-2026-87491, the bug is an out-of-bounds write in V8, the part of Chrome that runs JavaScript. This type of memory error could let a remote attacker run chosen code after someone loads a crafted web page.That code initially runs inside Chrome’s sandbox, a security barrier designed to restrict access to the rest of the device. The flaw therefore does not mean the attacker automatically gains unrestricted control of the whole PC, but it can provide an important foothold.
