Chrome 153 closes an exploited V8 write that Google still rates medium severity

Reach, not difficulty, is what medium severity measures here. Code running inside the renderer sandbox is not code on the host, and getting to the host needs a second bug and a working escape ^[30]. The rating tracks that limit, not the trigger, which is a page the browser renders ^[3].

Google's public position stops at awareness that an exploit exists ^[5]. Its stated reason for keeping the rest closed is that access to bug details stays restricted until a majority of users have the fix, and stays restricted if the flaw sits in a third-party library other projects depend on and have not yet fixed ^[6]. Help Net Security describes that as Google's usual practice while a fix is still rolling out ^[7]. The gap that matters operationally is a date: nothing published says whether the in-the-wild exploit predates Jihyeon Jeong's August 6, 2026 report or appeared after it ^[8][5], so the start of the exposure window is unknown outside Google.

The release around it is mostly internal yield. Google says it reported 195 of the 230 fixes ^[13], and SecurityWeek counts 35 from external researchers ^[14], which is 15.2 percent of the release ^[24]. Google credits AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer and AFL for many of its finds ^[17], and one high-severity use-after-free in WebPackaging is credited to OpenAI Codex Security ^[16]. On the external side, SecurityWeek puts disclosed bounty payments at roughly $23,000 with amounts for about two dozen reports still unpublished ^[15]. That leaves about 11 of the 35 external reports with a public price, averaging near $2,090 each, and the final bill higher ^[25].

Chrome's exploited zero-days this year did not land evenly across months. CVE-2026-2441 was patched in February, CVE-2026-3909 and CVE-2026-3910 in March, CVE-2026-5281 in April, CVE-2026-11645 in June, and CVE-2026-85046 the week before this one, according to Help Net Security ^[10]. So two exploited Chrome zero-days shipped fixes inside roughly a week, after a quiet stretch of about two months ^[27]. Both were reported publicly without an actor attached ^[5].

The fix is 153.0.8010.36 and .37 on Windows and macOS and 153.0.8010.36 on Linux ^[18]. It does not take effect until the browser process restarts, which is why Google's own check instruction ends at Relaunch ^[19]. On managed desktops where sessions live for days, the interval between a fleet holding the update and running it is the interval an attacker still has.