Affected Systems
Google Chrome versions prior to 153.0.8010.36/.37 (Windows/macOS) and 153.0.8010.36 (Linux). Affects V8 JavaScript engine. All Chromium-based browsers (Edge, Brave, Opera, Vivaldi) also vulnerable until patched.
Exploitation Status
Actively exploited in the wild. Google confirmed exploit exists but has not disclosed attack details, threat actors, or targeting scope. Exploit enables arbitrary code execution within Chrome's sandbox via crafted HTML page.
Business Impact
Out-of-bounds write in V8 allows remote attackers to execute arbitrary code inside Chrome's sandbox through malicious web pages. While sandboxed, this is the seventh Chrome zero-day exploited in 2026 and may be chained with sandbox escape exploits. CVSS score not yet published. Active exploitation confirmed but scope unknown. High user exposure given Chrome's market dominance.
Urgency
🔴 Immediate
Recommended Actions
- Update Chrome immediately to version 153.0.8010.36 or later via Settings > Help > About Google Chrome, then relaunch browser
- Identify and update all Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi) as vendor patches become available
- Monitor web proxy and endpoint logs for suspicious JavaScript execution patterns or V8 engine crashes indicating exploitation attempts
- Consider temporary browser isolation or restricted browsing policies for high-value targets until patching is verified across the fleet
- Review Chrome update compliance across enterprise endpoints; prioritize systems used by executives, finance, and IT staff