A bad website could use a bug in the part that runs website code (V8) of Chrome to run its own code on your computer. Attackers were already using it. Google fixed it in Chrome 153.0.8010.36. Edge is built on the same code and got the same fix. Both update themselves, but only after you restart the browser.
- Status
- Patched: update now
- Being attacked?
- Yes[1]
- Severity
- High
- Updated
Google says it is aware that attacks using CVE-2026-87491 exist. CISA lists it as used in real attacks (added 2026-09-09). Severity: Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked). First reported .
Am I affected?
You are at risk if Chrome is older than 153.0.8010.36 or Edge is older than 152.0.4191.66. Newer versions are safe from this one.
| App | Device | Affected | Fixed in |
|---|---|---|---|
| Google Chrome | Windows, Mac, Linux | Chrome versions before 153.0.8010.36 | 153.0.8010.36 or 153.0.8010.37[1] |
| Microsoft Edge | Windows, Mac | Edge versions before 152.0.4191.66 | 152.0.4191.66[3] |
How to check your version
These checks only look. They do not change anything on your computer.
Google Chrome on Windows
Easy way: Click the three dots at the top right > Help > About Google Chrome. Chrome checks for updates there, then click Relaunch.
Or type this in PowerShellRead-only. It only reads the version and changes nothing.
(Get-ItemProperty 'HKCU:\Software\Google\Chrome\BLBeacon' -ErrorAction SilentlyContinue).version
Google Chrome on Mac
Easy way: Chrome menu bar: Chrome > About Google Chrome.
Or type this in TerminalRead-only. It only reads the version and changes nothing.
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString
Google Chrome on Linux
Easy way: Chrome menu: three dots > Help > About Google Chrome.
Or type this in TerminalRead-only. It only reads the version and changes nothing.
google-chrome --version
Microsoft Edge on Windows
Easy way: Click the three dots at the top right > Help and feedback > About Microsoft Edge.
Or type this in PowerShellRead-only. It only reads the version and changes nothing.
(Get-Item "${env:ProgramFiles(x86)}\Microsoft\Edge\Application\msedge.exe" -ErrorAction SilentlyContinue).VersionInfo.ProductVersionMicrosoft Edge on Mac
Easy way: Edge menu bar: Microsoft Edge > About Microsoft Edge.
Or type this in TerminalRead-only. It only reads the version and changes nothing.
defaults read "/Applications/Microsoft Edge.app/Contents/Info" CFBundleShortVersionString
How to fix it
- In Chrome, open the three-dot menu > Help > About Google Chrome. It checks and downloads the update.
- Click Relaunch.
- In Edge, open the three-dot menu > Help and feedback > About Microsoft Edge, then click Restart.
More on each app: Is my Chrome up to date?, Is my Edge up to date?
Official links
Check before installing, and only use these official links or the app's own update button.
For AI agents
This page as data: /incidents/chrome-attacked-bug-sep-2026-b.json. All problems: /feed.json. Use read-only checks only, and ask before installing anything.
Tracking numbers (CVE): CVE-2026-87491
Sources
- MakerGoogle Chrome Releases: Stable Channel Update for Desktop (2026-09-08) (Sep 8, 2026)
- CISACISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-87491 (added 2026-09-09) (Sep 9, 2026)
- MakerMicrosoft: Release notes for Microsoft Edge security updates (Sep 4, 2026)
- NVDNVD: CVE-2026-87491 (Sep 8, 2026)
"Maker", "CISA", "NVD", "GitHub advisory" and "Official notice" are official sources. "Researcher" and "News" are extra context.