Google released Chrome 153 to fix CVE-2026-87491, an out-of-bounds write flaw in the V8 JavaScript and WebAssembly engine. Attackers already use an exploit for this vulnerability in the wild. The flaw affects desktop and Android users on Windows, macOS, and Linux. Chrome on iOS does not face this specific risk.
The security update addresses a medium-severity vulnerability that Jihyeon Jeong of Seoul National University reported. While Google classifies the risk as medium, the existence of active exploitation makes the patch a priority. Attackers use browser flaws to compromise devices when a victim encounters malicious content during web browsing. Sophisticated actors chain such weaknesses to penetrate devices more deeply.
| OS Platform | Required Chrome Version |
|---|---|
| Windows | 153.0.8010.36/.37 |
| macOS | 153.0.8010.36/.37 |
| Linux | 153.0.8010.36 |
| Android | 153.0.8010.36 |
Users on Windows and macOS should install version 153.0.8010.36 or 153.0.8010.37. Android users can find the update through Google Play. To update manually on a desktop, click the three-dot menu, select Settings, choose About Chrome, and let the browser install the version. A relaunch of the browser completes the process.
BlueMoon exploit kit targets Chromium users
The BlueMoon exploit kit targets Chrome and Chromium-based browsers by chaining three vulnerabilities. This kit combines a type-confusion bug in V8 (CVE-2026-85046) with a V8 sandbox escape (CVE-2026-87491) and a Windows kernel Local Privilege Escalation (LPE) zero-day (CVE-2026-85880). This combination allows attackers to escape the renderer process and inject code into the Chrome broker process.
Proofpoint identified four espionage-motivated threat actors using BlueMoon. The first cluster, tracked as TA412, appeared on 28 August 2026. Most of the actors using this kit have a suspected China nexus. UTA0560 and JungleBamboo used the same exploit chain but deployed different payloads. UTA0560 used the GRIMWEDGE JScript backdoor for host reconnaissance and command execution, while JungleBamboo used the SUPERSTOMP loader to install the LONGTALE credential-stealing Chrome extension.
The exploit kit uses a reflectively loaded DLL to fingerprint the Windows host. The JavaScript uses this information to decide if it should attempt the LPE exploit. The kit then uses a second reflectively loaded DLL to run the LPE exploit. This process allows the injector shellcode to execute an operator-specified command. The default command downloads a remotely hosted executable via a curl command.
The development of BlueMoon shows signs of rapid deployment. The infrastructure for exploit delivery was created on the same day as or the days before the campaigns. Proofpoint noted that the exploit chain’s default configuration lacks the operational security usually seen in browser exploit chains. Successful exploitation results in a curl command that downloads an executable, which creates high-signal detection opportunities for security products.
Analyzing the V8 type confusion bug
CVE-2026-85046 is a high-severity type confusion bug in the V8 engine with a CVSS score of 8.8. Security researcher Salvatore Gulizia discovered the flaw and reported it on 4 August 2026. The bug exists in the compilers, causing an array containing PACKED_ELEMENTS to receive the map PACKED_SMI_ELEMENTS. This flaw allows arbitrary read and write on the JavaScript heap.
The vulnerability exploits optimization assumptions in the Maglev and TurboFan JIT compilers. Both compilers attempt to optimize Array.prototype.sort by replacing built-in functions with specialized versions. An attacker can train the compiler to recognize optimized sort functions and then change the element kind mid-sort using a call to Array.fill(). This tricks the compiler into treating object references as small integers, creating a heap offset leak.
Google addressed this flaw in the Chromium source code on 3 September 2026. This created a patch gap where the vulnerability was an N-day at the Chromium source level before the official Chrome stable release. During this window, the vulnerability remained unpatched in the latest stable versions of Chrome and Microsoft Edge. The exploit kit developer likely used these public patches to weaponize the chain.
The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog on 4 September 2026. This addition required Federal Civilian Executive Branch agencies to apply the patches by 18 September 2026. For optimal protection, users of Microsoft Edge, Brave, Opera, and Vivaldi should also apply these fixes.
The Russian Laundry Bear campaign
The Russian state-sponsored actor Laundry Bear, also tracked as CL-STA-1114, Void Blizzard, or TA488, used a Zimbra Collaboration Suite zero-day to conduct espionage. This actor exploited CVE-2025-66376 starting in July 2025. The exploit is a "half-click" stored XSS vulnerability that requires no user interaction beyond viewing a crafted HTML email in a Zimbra Classic UI session.
The campaign targeted government, defense, transportation, and financial sectors in NATO member states, Ukraine, CIS countries, and Africa. In March 2026, Seqrite Labs documented a slice of this activity called Operation GhostMail, which targeted a Ukrainian State Hydrology Agency. This incident involved a phishing email sent on 22 January 2026 that used a deceptive internship inquiry lure.
The payload functions as a browser-resident stealer that executes in memory. When a user views the email, the exploit executes JavaScript that inherits the victim’s live Zimbra session. The script uses Promise.all to run nine operations in parallel before the tab closes. These operations include gathering email data, stealing credentials, harvesting browser-autofilled passwords, and exfiltrating 90 days of mail via DNS and HTTPS channels.
Laundry Bear’s effectiveness relied on a gap between the November 2025 patch and the public disclosure of the vulnerability. The group’s historical tradecraft involved password spraying and conventional phishing, but this exploit showed higher sophistication. Proofpoint assesses that Russian intelligence services likely supplied the exploit to the group.
Comparison of Chrome zero-day trends
Google manages a constant stream of zero-day vulnerabilities. The company reported 75 zero-days exploited in the wild in 2024, and this number rose to 90 in 2025. In 2025, enterprise technologies accounted for 48 percent of observed exploitation, or 43 cases. The current year has already seen several high-profile patches for V8 and CSS flaws.
| Year | Total Zero-Days Exploited in the Wild |
|---|---|
| 2024 | 78 |
| 2025 | 90 |
The year 2026 has seen multiple emergency updates. One early update addressed CVE-2026-2441, a high-severity use-after-free bug in the CSS component. This was the first confirmed zero-day patched by Google in 2026. Later, an emergency patch addressed CVE-2026-3910 in the V8 engine and CVE-2026-3909 in the Skia graphics library.
Google addressed six actively exploited Chrome zero-days since the start of 2026. These include CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, and CVE-2026-11645. Many of these flaws allow remote attackers to execute arbitrary code inside a sandbox via a crafted HTML page.
The frequency of these updates can cause disruption for IT administrators. Google announced that starting in September 2026, it will release beta and stable versions of Chrome every two weeks. This change aims to deliver fixes faster and minimize the impact of sudden vulnerabilities.
Technical breakdown of CVE-2026-2441
CVE-2026-2441 is a high-severity use-after-free vulnerability in Chrome’s CSS component. Shaheen Fazim discovered and reported the issue on 11 February 2026. Google released a fix in the Stable channel on 13 February 2026. The vulnerability allows a remote attacker to execute arbitrary code inside the sandbox through a crafted HTML page.
The flaw occurs when Chrome sets aside memory for a CSS element and marks it as deleted, but then attempts to access that memory address again through an invalid reference. Attackers use intricate JavaScript to modify CSS stylesheets in unexpected ways to trigger this memory corruption. This allows the attacker to overwrite memory content and gain control of the system by having a user view a malicious webpage.
The vulnerability affects Chrome versions prior to 145.0.7632.75/76 for Windows and macOS, and 144.0.7559.75 for Linux. Users must restart the browser for the patch to take effect. If a user does not relaunch Chrome after an update, the system remains vulnerable to this exploit.
The risk of this vulnerability involves browser crashes, data corruption, and the execution of malicious code. Because the bug involves core CSS rendering, users cannot disable the feature to stay safe without breaking website functionality. Does the rapid cycle of these CSS-based flaws indicate a fundamental weakness in how browsers handle web styling?
Mitigating the risk of browser exploits
Patching remains the most effective way to reduce exposure to cyberattacks. Users should install security updates as soon as they become available. For Chrome users, this means checking settings or allowing automatic updates and restarting the browser. For Android users, this involves checking Google Play for Chrome updates.
Security professionals should also consider the limitations of browser-based security. Some tools claim to harden browsers by disabling features like Just-In-Time (JIT) compilation or WebGPU. However, these tools often fail to block flaws in core components like CSS, which the browser must render to display websites.
Organizations can adopt proactive defense strategies like Cloud Isolation. This approach executes web content in disposable cloud containers, which prevents memory corruption exploits from reaching the user’s device. This method attempts to break the cycle of patching vulnerabilities like CVE-2026-87491 or CVE-2026-2441.
Additional defenses include:
- Avoiding suspicious links in emails, messages, and websites.
- Using mobile data or personal hotspots instead of public hotel or airport Wi-Fi.
- Blocking device code flow through Conditional Access policies to prevent session hijacking.
- Running dedicated security solutions across personal and corporate devices.
Summary of critical Chrome vulnerabilities
The following table lists recent high-severity Chrome vulnerabilities and their primary impact.
| CVE ID | Component | Severity | Primary Impact |
|---|---|---|---|
| CVE-2026-85046 | V8 Engine | High | Arbitrary read/write on JavaScript heap |
| CVE-2026-87491 | V8 Engine | Medium | Arbitrary code execution in sandbox |
| CVE-2026-2441 | CSS | High | Arbitrary code execution in sandbox |
| CVE-2026-3910 | V8 Engine | High | Arbitrary code execution in sandbox |
| CVE-2026-5281 | Dawn (WebGPU) | High | Arbitrary code execution in sandbox |
Users on Windows and macOS should ensure they are running at least version 153.0.8010.36 to protect against the latest V8 flaws. Linux users should verify they have version 153.0.8010.36 installed. For Chromium-based browsers like Microsoft Edge and Brave, users must watch for vendor-specific patches following these Google releases.
The recurring nature of these vulnerabilities shows that attackers continue to target the browser engine. The ability to chain multiple flaws, such as combining V8 bugs with Windows kernel bugs, allows even medium-severity flaws to become part of highly effective espionage tools. Stay updated to minimize the window of opportunity for these exploit kits.
