Google Releases Chrome 153 Fixing 230 Vulnerabilities Including Zero-Day Exploit
Google has released Chrome 153 on September 8, 2026, addressing a total of 230 vulnerabilities, including a zero-day flaw already under active exploitation.
The update ships as version 153.0.8010.37 and 153.0.8010.36 for Windows and macOS, and 153.0.8010.36 for Linux. Five issues rated Critical were resolved, covering use-after-free vulnerabilities in WebGL (CVE-2026-87464 and CVE-2026-87488), an out-of-bounds write (CVE-2026-87438), a buffer overflow (CVE-2026-87527), and a use-after-free in the Cast component (CVE-2026-87628).
Additional high-severity fixes were applied across multiple components including ANGLE, PDFium, V8, DevTools, Web Authentication, and Payments. The medium-severity zero-day CVE-2026-87491 in the V8 engine involves an out-of-bounds write and was reported on August 6, 2026; exploitation has already been confirmed.
Full list of patched CVEs
Critical: CVE-2026-87438, CVE-2026-87464, CVE-2026-87488, CVE-2026-87527, CVE-2026-87628
High: CVE-2026-87440, CVE-2026-87444, CVE-2026-87447, CVE-2026-87460, CVE-2026-87467, CVE-2026-87474, CVE-2026-87480, CVE-2026-87492, CVE-2026-87498, CVE-2026-87499, CVE-2026-87500, CVE-2026-87512, CVE-2026-87514, CVE-2026-87517, CVE-2026-87520, CVE-2026-87524, CVE-2026-87525, CVE-2026-87536, CVE-2026-87542, CVE-2026-87552, CVE-2026-87554, CVE-2026-87558, CVE-2026-87564, CVE-2026-87569, CVE-2026-87572, CVE-2026-87578, CVE-2026-87581, CVE-2026-87585, CVE-2026-87587, CVE-2026-87596, CVE-2026-87604, CVE-2026-87607, CVE-2026-87612, CVE-2026-87621, CVE-2026-87633, CVE-2026-87639, CVE-2026-87646, CVE-2026-87647, CVE-2026-87650, CVE-2026-87651, CVE-2026-87654
Medium: CVE-2026-87431 through CVE-2026-87658 (115 CVEs total, including the exploited CVE-2026-87491)
Low: CVE-2026-87429, CVE-2026-87430, CVE-2026-87437 and 48 additional low-severity issues
Google plans to complete the staged rollout over the next several days to weeks.
Related articles
Top 5 Cybersecurity Events of the Week: Barracuda Root Exploits, cPGuard Supply-Chain Attack, APT Flaw, Xen Escape Bugs, and OpenSSH Authentication Bypass
This week’s Jet CSIRT roundup highlights five critical security issues affecting widely deployed infrastructure. Two high-severity vulnerabilities in Barracuda Email Security Gateway and other appliances allow unauthenticated attackers to obtain root access via authorization bypass and command injection. A supply-chain compromise of cPGuard versions 5.88.12–5.88.19 enabled theft of password hashes, database files, and SSH keys from at least 32 customer servers before the malicious update was removed. A flaw in the APT package manager (CVE-2026-109518) lets network attackers substitute malicious packages that execute with root privileges on Debian and Ubuntu systems. Two Xen hypervisor bugs (CVE-2026-102703 and CVE-2026-102704) permit a compromised guest VM to read and write memory belonging to dom0 and other guests. Finally, an OpenSSH authentication bypass on musl-based Alpine Linux distributions allows passwordless login to key-only accounts when long password hashes trigger a crypt() return value of “*”.
CISA and FBI Warn of Global Cyber Attacks on Industrial Refrigeration and Cold Chain Controllers
CISA, the FBI, and multiple U.S. agencies issued a joint advisory on November 5 detailing malicious cyber activity targeting industrial refrigeration systems and cold chain monitoring equipment worldwide. Attackers are exploiting unpatched or internet-exposed temperature controllers in supermarkets and cold storage facilities through authentication bypass, arbitrary code injection, and weak configurations. Once inside the control panels, threat actors force units into continuous heating and defrost cycles, the opposite of their intended function, while also causing denial of visibility that prevents operators from seeing real equipment status. The advisory highlights risks including reduced system lifespan, fire hazards, stock loss, and potential consumer harm from spoiled products stored outside safe temperature ranges. Sectors most affected include public health, chemical manufacturing, food and agriculture, and refrigerated transportation. Recommended mitigations focus on network segmentation, removal of remote access from the public internet, strong authentication, firmware updates, and regular offline backups.
Critical Flaw in React Server Components Enables Unauthenticated Remote Code Execution
The React team disclosed security advisory GHSA-xqc2-xf4c-x3h3 describing a high-impact vulnerability in React Server Components that can lead to remote code execution. The flaw affects packages react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack across multiple version ranges from 19.0.0 through 19.3.0. Exploitation requires no authentication, privileges, or user interaction, allowing a remote attacker to execute code on the server by sending a specially crafted request containing multiple typed arrays alongside attacker-controlled data. No CVE identifier was assigned, and the advisory notes that the issue is distinct from the previously reported React2Shell vulnerability tracked as CVE-2025-55182. Affected applications are limited to those running React code on the server with supported frameworks and bundlers; client-only React usage is unaffected. Patches are available in versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1, with immediate updates strongly recommended. The React team also linked similar typed-array handling issues in Next.js Cache Components, suggesting a broader class of errors.
Plex Media Server Vulnerabilities Exploited in Wild via Plex2Shell Chain
Plex has disclosed active exploitation of four vulnerabilities in Plex Media Server versions 1.43.2 and earlier. The flaws, tracked as CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, allow unauthenticated remote code execution when chained together. Attackers are leveraging server-side request forgery and token-handling weaknesses to write arbitrary files on exposed servers. Proof-of-concept code named Plex2Shell was published on 16 October, after which CISA added the issues to its Known Exploited Vulnerabilities catalog. Compromised systems have been observed deploying cryptocurrency miners and proxy relays. The software is widely used both as a standalone media server and as an add-on for QNAP and other NAS devices, increasing the potential attack surface.