Google Just Patched Chrome’s Seventh Zero-Day of 2026. Here’s Why You Should Update Right Now

Google pushed four separate security updates for Chrome on desktop in just two weeks this September, and two of them fixed flaws that hackers were already using in real attacks. The most recent confirmed active exploit, tracked as CVE-2026-87491, was patched on September 9 and 10 and marked the seventh time in 2026 that Google has had to fix a Chrome bug already being exploited in the wild. A separate, larger update followed on September 17 that closed 16 more security issues, including two critical ones, before anyone was reported to have used them.

None of this means Chrome is unusually unsafe to use. It means the opposite is happening quietly in the background: Google is catching and closing these holes, often within days of learning about them. But the pace this month is a useful reminder of something a lot of people ignore, that little “Chrome is out of date” notice matters more than it looks.

Here is what actually happened, how serious it is, and exactly what you should do about it right now.

Quick Summary

• Google shipped four Chrome desktop security updates between September 4 and September 17, 2026.
• Two of them, on September 4 and September 9-10, fixed vulnerabilities that were already being exploited by attackers.
• The September 9-10 flaw, CVE-2026-87491, was Chrome’s seventh actively exploited zero-day of the year.
• The current stable version as of this week is Chrome 153.0.8010.52/.53 for Windows and Mac, and 153.0.8010.52 for Linux.
• No special action is needed beyond making sure Chrome has actually restarted to finish installing its latest update.
• Users of Chromium-based browsers like Edge, Brave, Opera, and Vivaldi should watch for matching updates from those vendors.

What Happened?

Chrome updates constantly, but September 2026 has been busier than usual. Google’s own Chrome Releases blog lists four stable-channel desktop updates in a roughly two-week stretch:

• September 4: Chrome 152.0.7977.82/.83 fixed CVE-2026-85046, a type confusion bug in Chrome’s V8 JavaScript engine that Google confirmed was already being exploited.
• September 9-10: Chrome 153.0.8010.36/.37 fixed CVE-2026-87491, an out-of-bounds write bug, also in V8, that Google again confirmed was being actively exploited.
• September 15: Chrome 153.0.8010.47/.48 addressed 42 separate security issues, three of them rated critical, covering WebGL, internal browser components, and background worker processes.
• September 17: Chrome 153.0.8010.52/.53 fixed 16 more issues, including two critical bugs, a use-after-free flaw in Chrome’s Dawn graphics component and a buffer overflow in WebGL.

Google has not said either of the September 15 or September 17 batches was being exploited before the fix. Those look like Google’s own security team and outside researchers finding and closing holes ahead of attackers, which is exactly how the process is supposed to work.

How Serious Is It?

The two actively exploited bugs, CVE-2026-85046 and CVE-2026-87491, both lived in V8, the engine that runs the JavaScript on nearly every website you visit. Security researchers described both as capable of letting an attacker run malicious code inside Chrome’s sandbox, the isolated space Chrome uses to keep a bad webpage from touching the rest of your computer, just by getting a victim to load a booby-trapped page.

That sandbox is an important detail. It does not mean these bugs were harmless. It means a successful attack using one of them typically needs to be paired with a second bug that breaks out of the sandbox to fully take over a device, which is a higher bar for attackers to clear, though not an impossible one for well-resourced ones. Google’s own security advisories for both CVEs used the same short, serious line, “Google is aware that an exploit… exists in the wild,” which is the company’s standard language for confirming real-world attacks rather than a theoretical risk.

For most home users, the realistic danger is a targeted attack, someone using the flaw to go after a specific person or organization, rather than mass, random exploitation of every Chrome user on Earth. That is still a real risk, just not a reason to panic about everyday browsing.

Timeline: Four Updates in Two Weeks

Has It Been Fixed?

Yes, for all four issues above. If your Chrome has restarted since September 17, you are already running the patched version. Chrome downloads updates automatically in the background, but it only finishes installing them, and actually protects you, once you close and reopen the browser or hit “Relaunch” when prompted. A Chrome window that has been open for days or weeks can be sitting on a much older, unpatched version without you realizing it.

What You Should Do Right Now

Checking your Chrome version takes under a minute:

• Open Chrome.
• Click the three-dot menu in the top-right corner, then go to Help > About Google Chrome (on some setups this is under Settings > About Chrome).
• Chrome will automatically check for updates and show your current version. If it finds a newer one, it will download it and show a Relaunch button.
• Click Relaunch to finish installing the update. Your tabs will reopen automatically.

You should be on version 153.0.8010.52 or later (or 153.0.8010.53 on Windows/Mac) to have all of September’s fixes. If you use a Chromium-based browser instead of Chrome itself, such as Microsoft Edge, Brave, Opera, or Vivaldi, check that browser’s own update settings, since each vendor ships its V8 and Chromium security fixes on its own schedule, sometimes a few days behind Chrome.

Is Chrome Getting Less Secure?

Not necessarily, and this is worth explaining clearly rather than letting the raw numbers cause alarm. Chrome is one of the most heavily scrutinized pieces of software in the world. Google runs a large internal security team and pays out substantial bug bounties, in these cases, $1,000 and $2,500 to the two researchers who reported the exploited flaws, which pulls in a constant stream of outside researchers actively hunting for bugs. More scrutiny generally means more bugs get found and fixed, including, occasionally, ones that attackers found first.

Seven actively exploited zero-days by mid-September is a genuinely high number for one year, and it is fair to call 2026 a busy year for Chrome’s security team. It is not the only browser vendor scrambling to ship urgent fixes lately either, Microsoft’s own emergency Windows patch earlier this month shows the same pattern playing out across the industry. But the pattern so far this year is Google finding out about these bugs and shipping a fix within days, which is the outcome you want, even if it does not feel that way when the update notifications keep coming.

What We Still Don’t Know

Google deliberately withholds technical exploit details for actively-exploited bugs like these until most users have updated, so the public does not yet know exactly who was behind the attacks that used CVE-2026-85046 or CVE-2026-87491, or how widely they were used before being patched. It is also not yet clear whether either flaw was used in a broader campaign or in narrow, targeted attacks. If more details emerge, security researchers will likely publish deeper technical write-ups once the update has had more time to reach users.

What Happens Next?

Chrome ships new stable updates roughly every two weeks as part of its regular release cycle, with emergency out-of-cycle patches whenever an actively-exploited bug turns up in between. Given how often that has happened this year, more updates, and more one-line “Google is aware of an exploit” advisories, are likely before 2026 is over. The single best long-term habit is simple, don’t let your browser windows sit open for weeks at a time, and click “Relaunch” the moment Chrome asks for it. If you also want to keep the rest of your system current, our guide to getting Windows 11 version 26H2 early covers the operating system side of that habit.

Want to lock down the rest of your online life too? Follow our step-by-step guide to setting up passkeys on iPhone, Android and Windows, and learn how to turn off ChatGPT ad tracking.

FAQs

Is Chrome safe to use right now?
Yes, as long as you are running an up-to-date version. All four vulnerabilities discussed here are already fixed in the current stable release.

How do I know what version of Chrome I have?
Go to the three-dot menu, then Help > About Google Chrome (or Settings > About Chrome). The page shows your current version and updates automatically if you’re behind.

Does Chrome update itself automatically?
Chrome downloads updates in the background on its own, but it needs a restart, either you closing and reopening it, or clicking “Relaunch,” to actually apply the fix.

Are Edge, Brave, and other Chromium browsers affected too?
Many of them share Chrome’s underlying code, including the V8 engine, so they can be affected by the same bugs. Each browser maker patches on its own schedule, so check each one’s own update settings separately.

Why does Google sometimes not share technical details about these bugs?
Google restricts technical details on actively-exploited flaws until most users have updated, so attackers can’t use the writeup as a roadmap against people who haven’t patched yet.

Should I be worried about a targeted attack?
For most everyday users, no. These exploits are more useful for attackers going after specific high-value targets. Keeping Chrome updated closes the door regardless of who the intended target was.