How to Update Chrome 153 to Fix Its Exploited Zero-Day

Chrome 153 includes a security fix for CVE-2026-87491, an out-of-bounds write vulnerability in Google's V8 JavaScript and WebAssembly engine that Google says is already being exploited in the wild. The flaw is rated medium severity, but active exploitation makes the update more urgent than its severity label suggests. This guide shows how to check your Chrome version, trigger the update, confirm the patched build, and verify that all browser profiles on your computer are covered.

Why you should update Chrome 153 now

CVE-2026-87491 affects V8, the engine Chrome uses to execute JavaScript and WebAssembly code inside web pages and applications. An out-of-bounds write occurs when software writes data beyond the memory area allocated for an operation, which can lead to memory corruption and potentially provide an attacker with a path toward code execution. Google has explicitly confirmed that an exploit for this vulnerability exists in the wild, so this is not simply a theoretical weakness waiting for a future attacker.

Google's Chrome 153 desktop security update includes the fix, and the company lists CVE-2026-87491 as a medium-severity vulnerability. The severity rating should not be interpreted as a reason to postpone the update because exploitation status provides additional context that the numerical rating does not capture. Google also credits the discovery to Jihyeon Jeong of Compsec Lab at Seoul National University, who received a $2,500 bug bounty for the report.

Check which Chrome version you have installed

Before updating, check the browser version currently running on your computer. Open Chrome, select the three-dot menu in the upper-right corner, choose Help, and then select About Google Chrome. Chrome will display the installed version and automatically check whether a newer release is available.

Chrome 153 is the release containing the relevant security fix. Google has shipped different build numbers across operating systems and release stages, so the version number shown on your computer is more useful than relying on a generic instruction such as “install Chrome 153.” The About page also tells you whether Chrome is waiting for a restart, which is the final step required to activate an already-downloaded update.

Let Chrome download the security update

If Chrome reports that an update is available, allow the browser to download it completely. You do not normally need to find a separate security patch because Chrome's browser update mechanism delivers the security fixes as part of the browser release. Keep your important tabs and unsaved work in mind before restarting, since the browser needs to close and reopen to finish applying the update.

If Chrome says it is already up to date, do not repeatedly download an installer simply because you saw a report about the vulnerability. First compare the exact installed version shown on the About page with the current release offered by Google's update channel. Chrome releases can roll out gradually, and Google's release notes can also list separate builds for Windows, macOS and Linux.

Restart Chrome to activate the fix

When an update has been downloaded, Chrome displays a Relaunch button on its About page. Select it after saving anything that needs to remain open. Chrome will close its windows, apply the update, and reopen the browser with the new version.

Do not consider the download complete merely because Chrome reports that an update is ready. The running browser process must restart before you can be confident that the newly installed V8 components are being used. This is especially relevant for a memory-safety vulnerability because an older browser process can continue running vulnerable code until it is closed.

Verify the patched Chrome build

Return to Help and About Google Chrome after the restart. Confirm that Chrome reports the updated release rather than the older build you started with. The page should also report that Chrome is up to date.

If the browser refuses to restart or continues showing the older version, close every Chrome window and start the browser again. If the problem remains, check whether your computer is managed by an organization because administrators can control Chrome update policies. On managed systems, forcing a personal installation over an administrator-controlled browser can create a different maintenance problem rather than fixing the underlying update issue.

Check Chrome on Android separately

Chrome for Android received the corresponding Chrome 153 security fixes, with Google listing version 153.0.8010.36 for the September 8 release. Google said the Android release would become available through Google Play over the following days and that it contains the same security fixes as the corresponding desktop release unless otherwise specified.

On Android, open Google Play, search for Chrome, and check whether an Update button is available. After updating, open Chrome and check its version from the browser's settings and application information. If automatic updates are enabled, the update may already have been installed without requiring a manual download.

Do not confuse the zero-day with every Chrome security issue

CVE-2026-87491 is only one entry in Chrome 153's security fixes. Google's release notes list additional vulnerabilities across components including WebGL, Cast, ANGLE, PDFium, DevTools and V8. That matters because updating Chrome is broader than applying a single CVE patch: the browser release brings a collection of fixes that are intended to move users onto a safer build.

The V8 flaw also illustrates why browser security cannot be judged by the CVE severity number alone. Google describes the vulnerability as medium severity but simultaneously states that exploitation exists in the wild. For an ordinary Chrome user, that combination makes the practical decision straightforward: update through the browser's normal channel rather than waiting for evidence that the vulnerability affects your particular websites or account.

What to do if Chrome cannot update

If Chrome cannot update, first restart the computer and check the About page again. Make sure the operating system has enough free storage and that security software or network controls are not blocking Chrome's update process. On managed business computers, contact the administrator instead of bypassing the organization's browser policy.

Until the browser can be updated, avoid treating private browsing mode, clearing cookies, or disabling JavaScript as substitutes for the security patch. Those actions do not replace the vulnerable browser component with a fixed version. The durable fix is to get Chrome onto the patched release and confirm the new version after restarting.

Keep Chrome updates enabled after this fix

Chrome's update system exists precisely because browser vulnerabilities can require rapid distribution of fixes. Google's September release demonstrates why checking the version matters even when the browser appears to work normally: CVE-2026-87491 did not require a visible browser failure for users to be exposed to the underlying defect.

Once Chrome 153 is installed and verified, leave normal browser updates enabled unless an administrator manages them for you. The immediate task is to close the known exploited vulnerability, but the more useful security habit is to treat browser updates as part of routine protection rather than something to investigate only after a vulnerability becomes news.