VULNpocalypse
HighVulnerabilityPatch available

Chrome zero-days in 2026: seven exploited bugs patched by September, the latest fixed in Chrome 153

Google patched seven Chrome bugs exploited in the wild from February to September 2026. Update Chrome and any bundled Chromium to 153.0.8010.36 or later.

Published
Updated
Fixed in
Chrome 145.0.7632.75, 146.0.7680.75, 146.0.7680.80, 146.0.7680.177, 149.0.7827.102, 152.0.7977.82, 153.0.8010.36 (Linux build numbers; Windows and Mac builds end one higher)
Exploitation
Yes. Google confirmed an exploit in the wild for each; all seven are in CISA KEV, added between 17 February and 9 September 2026

Live scores

CVE-2026-2441
EPSS
0.550
very likely to be attacked soon
VEDAS
0.982
strong exploit evidence
On CISA KEV
Yes, since 2026-02-17
Detection rule
None yet
EPSS (chance of attack)
10No cve-scores data 2026-02-22 to 2026-08-08no data0.1CVE-2026-2441 EPSS over time2026-022026-11-01
VEDAS (exploit evidence)
10No cve-scores data 2026-02-22 to 2026-08-08no data0.9CVE-2026-2441 VEDAS over time2026-022026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Live scores

CVE-2026-3909
EPSS
0.023
some chance of attack soon
VEDAS
0.975
strong exploit evidence
On CISA KEV
Yes, since 2026-03-13
Detection rule
None yet
EPSS (chance of attack)
100.1CVE-2026-3909 EPSS over time2026-082026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-3909 VEDAS over time2026-082026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Live scores

CVE-2026-3910
EPSS
0.027
some chance of attack soon
VEDAS
0.976
strong exploit evidence
On CISA KEV
Yes, since 2026-03-13
Detection rule
None yet
EPSS (chance of attack)
100.1CVE-2026-3910 EPSS over time2026-082026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-3910 VEDAS over time2026-082026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Live scores

CVE-2026-5281
EPSS
0.137
likely to be attacked soon
VEDAS
0.979
strong exploit evidence
On CISA KEV
Yes, since 2026-04-01
Detection rule
None yet
EPSS (chance of attack)
100.1CVE-2026-5281 EPSS over time2026-082026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-5281 VEDAS over time2026-082026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Live scores

CVE-2026-11645
EPSS
0.024
some chance of attack soon
VEDAS
0.976
strong exploit evidence
On CISA KEV
Yes, since 2026-06-09
Detection rule
None yet
EPSS (chance of attack)
100.1CVE-2026-11645 EPSS over time2026-082026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-11645 VEDAS over time2026-082026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Live scores

CVE-2026-85046
EPSS
0.018
some chance of attack soon
VEDAS
0.981
strong exploit evidence
On CISA KEV
Yes, since 2026-09-04
Detection rule
None yet
EPSS (chance of attack)
100.1CVE-2026-85046 EPSS over time2026-092026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-85046 VEDAS over time2026-092026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Live scores

CVE-2026-87491
EPSS
0.035
some chance of attack soon
VEDAS
0.979
strong exploit evidence
On CISA KEV
Yes, since 2026-09-09
Detection rule
None yet
EPSS (chance of attack)
100.1CVE-2026-87491 EPSS over time2026-092026-11-01
VEDAS (exploit evidence)
100.9CVE-2026-87491 VEDAS over time2026-092026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

What happened

Between February and September 2026, Google shipped emergency fixes for seven Chrome vulnerabilities. For each one, its release notes said Google “is aware that an exploit ... exists in the wild”. CISA added all seven to its Known Exploited Vulnerabilities catalog (CISA KEV). Google has not said who used them or against whom.

CVEComponent and bugFixed in (Linux / Windows and Mac)ReleaseAdded to KEV
CVE-2026-2441CSS, use after free145.0.7632.75 / .75 or .7613 Feb17 Feb
CVE-2026-3910V8, inappropriate implementation146.0.7680.75 / .75 or .7612 Mar13 Mar
CVE-2026-3909Skia, out-of-bounds write146.0.7680.8013 Mar13 Mar
CVE-2026-5281Dawn (WebGPU), use after free146.0.7680.177 / .177 or .17831 Mar1 Apr
CVE-2026-11645V8, out-of-bounds read and write149.0.7827.102 / .102 or .1038 Jun9 Jun
CVE-2026-85046V8, type confusion152.0.7977.82 / .82 or .833 Sep4 Sep
CVE-2026-87491V8, out-of-bounds write153.0.8010.36 / .36 or .378 Sep9 Sep

Sources for each row: Google’s release notes for 13 February, 12 March, 13 March, 31 March, 8 June, 3 September and 8 September, plus the CVE records and the CISA KEV feed.

Some details worth knowing:

  • CVE-2026-3909 was pulled from the 12 March release. Google’s notes say the fix “will instead be available in a future update”, and it shipped the next day in 146.0.7680.80 (Google). The CVE record still says “prior to 146.0.7680.75” (CVE record). Treat 146.0.7680.80 as the fixed build.
  • CVE-2026-3909 and CVE-2026-3910 were both reported by Google’s Threat Analysis Group on 10 March (Google).
  • CVE-2026-5281 in Dawn, Chrome’s WebGPU implementation, needs an attacker who has already compromised the renderer process. That makes it a likely second stage in a chain (CVE record; The Hacker News).
  • CVE-2026-85046 was reported by Salvatore Gulizia on 4 August and was the sixth Chrome zero-day of the year (Help Net Security).
  • CVE-2026-87491 was fixed in the release that promoted Chrome 153 to stable, five days later. Google rated it Medium; CISA’s enrichment scores it CVSS 8.8 (Google; CVE record).

CISA notes that these flaws can affect other Chromium browsers, including Microsoft Edge and Opera (CISA KEV).

Am I affected?

Any Chrome older than 153.0.8010.36 is missing at least one of these fixes. Check the browser and every place Chromium hides:

bash
# Linux
google-chrome --version
chromium --version

# macOS
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --version

# Windows (PowerShell): installed Chrome version
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

In Chrome itself, open chrome://settings/help. An update that has downloaded does not apply until Chrome restarts.

For bundled Chromium, check the Chromium version the app ships, not the app’s own version number:

bash
# Puppeteer: print the browser version it launches
node -e "const p=require('puppeteer');p.launch().then(async b=>{console.log(await b.version());await b.close()})"

# Docker images used for headless scraping or testing
docker run --rm <image> chromium --version

In an Electron app, process.versions.chrome shows the embedded Chromium version. CI images pinned months ago are the most likely to be behind.

What to do now

  1. Update Chrome to 153.0.8010.36 or later and restart it. Use your management tool to report the running version, not just the installed one. Users who never close Chrome stay vulnerable after the download.
  2. Update other Chromium browsers. Edge, Brave, Opera and Vivaldi ship the fixes in their own releases; check each vendor’s release notes for a build based on Chromium 153 or later (The Hacker News).
  3. Rebuild CI and scraping images that contain Chromium, and bump Playwright, Puppeteer and similar tools so they download a current browser. For Playwright, run npx playwright install chromium after the upgrade. A headless browser that loads untrusted pages is exposed in the same way a desktop is.
  4. Ask vendors of Electron and CEF apps which Chromium version their current release ships, and update. The sources do not list fixed Electron or CEF versions.

Sources