Column 1
Skip to content

Chrome 153 Security Update: CVE-2026-87491 Is in CISA KEV

September 9, 2026

September 9 Update: CVE-2026-87491 Is Now in CISA KEV

CISA added the Chromium V8 vulnerability CVE-2026-87491 to its Known Exploited Vulnerabilities catalog on September 9, 2026. This adds confirmed exploitation urgency to the Chrome 153 maintenance checklist below. It is not evidence that a particular reader or customer device has been compromised.

The Chrome CNA record identifies Chrome releases before 153.0.8010.36 as affected. Use the latest supported Stable release for the device, apply the update, and relaunch Chrome. Check the resulting version through Help, then About Google Chrome, or the approved fleet inventory. Follow each other Chromium-based browser vendor’s own release guidance rather than assuming its version numbering or patch status matches Chrome.

The CISA KEV catalog lists September 23 as this entry’s due date. That catalog date is not a reason to postpone an available update. Organizations subject to CISA directives should follow the applicable directive and vendor guidance; other teams should prioritize exposed and privileged-use devices under their own maintenance process. Verify normal business sign-ins after relaunch and follow the established incident-response process if compromise is suspected.

Chrome 153 is a substantial browser security-maintenance release. Google lists 230 security fixes, including critical fixes, for the September 8, 2026 Stable Channel release. Organizations that use Chrome on workstations, support devices, or shared administration machines should move to the current Stable Channel release through their normal maintenance process.

This is defensive maintenance guidance. It does not claim that a particular FixItPhill reader, managed device, or customer environment is affected. The practical reader action is to update supported browser installations, confirm the resulting version through the normal fleet or device inventory, and make sure ordinary business browsing still works as expected.

Who Should Prioritize This Update

  • Teams that use Chrome on administrator workstations, support desks, shared business devices, or web-hosting operations consoles.
  • Organizations that manage Chrome through an endpoint-management service, policy, or a standard desktop-maintenance process.
  • Small businesses and agencies whose browser sessions reach hosting panels, ecommerce dashboards, analytics, email, or other important web services.

Use the Normal Chrome Update Path

  1. Review the current Stable Channel announcement and identify the normal update path for each managed operating system.
  2. Schedule the browser update through the established device-management or local maintenance process. Keep recovery arrangements and normal change records appropriate to the environment.
  3. Confirm that Chrome reports the current Stable Channel version after the update. Restart the browser when the update process requests it.
  4. Verify a small set of approved business workflows, such as sign-in, customer support, webmail, hosting administration, or ecommerce administration, without changing browser security policies to work around a problem.
  5. Record update completion in the normal inventory or support process and follow up on devices that remain outside the intended release channel.

Keep Browser Maintenance Separate From a Narrow CVE Guide

FixItPhill’s earlier Chrome CVE-2026-11645 guide addresses a specific CISA KEV issue. This checklist covers the broader Chrome 153 Stable Channel maintenance release and should not be used to infer that every browser issue has the same exposure or remediation scope.

If an Update Cannot Be Completed Immediately

Use the organization’s approved maintenance process to arrange the earliest supported update window. Restrict browser administration to the people who need it, avoid unnecessary use of sensitive web consoles on out-of-date devices, and preserve normal monitoring and support access. Temporary operational care does not replace updating the browser.

Related FixItPhill Guidance

For safe checks after a customer-facing WordPress or web-service change, see the FixItPhill WordPress support hub and the WordPress cache and CDN testing guide.

Sources