On September 8, 2026, Google ships Chrome 153, fixing 230 vulnerabilities including CVE-2026-87491, an out-of-bounds write in V8 already exploited in the wild. Update to 153.0.8010.36 or later before the CISA deadline of September 23, and check every Chromium browser in your fleet, Edge, Brave and Opera included.
On September 4, 2026, Google shipped an emergency Chrome update fixing CVE-2026-85046, a type confusion in the V8 engine already exploited in the wild and rated 8.8 on the CVSS scale. Update to Chrome 152.0.7977.82 or later and check every Chromium browser in your fleet, including Edge, Brave and Opera.
On August 3, 2026, Unit 42 (Palo Alto Networks) published three attacks dubbed Pass-ta-key that allow malware on a compromised Windows machine to hijack passkeys synced through Google Password Manager. The most severe, Golden Pass-ta-key, extracts the master encryption key from Chrome's memory and compromises all current and future passkeys on the victim's Google account.
On March 31, 2026, Google shipped an emergency patch for CVE-2026-5281, an already-exploited use-after-free in Dawn, Chromium’s WebGPU implementation. It’s Chrome’s fourth zero-day in four months — and a clear signal that low-level graphics APIs have become the browser exploitation frontier.
