# Chrome’s Latest Zero-Day Fix Needs One More Click

> Google has fixed a Chrome flaw already used in attacks. The useful response is calm and small: update, relaunch, and check the version that is actually running.

- **Author:** Kubilay Tunca
- **Published:** 2026-09-16
- **Category:** For Mortals
- **Tags:** Online Safety, Software Updates, Web Browsers
- **Canonical URL:** https://cyber-security-in-plain-english.com/post/mortals/news/chrome-update-needs-relaunch-receipt

---

Your browser may have downloaded a security update while you were answering email, paying a bill, or watching a video. That sounds like the job is finished. Often, one ordinary step remains: the browser has to close and reopen before the repaired version takes over.

That small gap matters this week. On 8 September 2026, Google released Chrome 153 for Windows, macOS, and Linux with a fix for CVE-2026-87491, a flaw in the part of Chrome that processes code on web pages. Google also said an exploit for the flaw “exists in the wild,” which means somebody had already found a way to use it outside a test lab ([Google Chrome Releases: Stable Channel Update for Desktop](https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html)).

There is no need to learn the flaw’s catalogue number or spend the evening reading attack reports. Open Chrome’s About page, let it check, press **Relaunch** if that button appears, then return once to see the version now running. That is the whole household assignment. The rest of this article explains why those few clicks count as proof, where automatic updates can pause, and what to do if Chrome is not the browser you use.

## What Google Fixed on 8 September

Chrome does much more than display text and pictures. Modern websites contain small programs that sort a shopping basket, draw a map, open a document, play a game, or update a bank balance without reloading the page. Chrome uses an engine called V8 to run much of that code. CVE-2026-87491 is an “out-of-bounds write” in V8, which means carefully prepared page code can make the engine write data beyond the part of memory it was meant to use ([NVD: CVE-2026-87491](https://nvd.nist.gov/vuln/detail/CVE-2026-87491)).

Think of a hotel clerk who should place each guest’s key in one labelled box. An out-of-bounds write is closer to finding a way to push a key through the back of that box and into the cabinet beside it. What happens next depends on the exact layout of the cabinet and what other weaknesses are available. The important point for a normal browser user is simpler: a malicious page can give the browser instructions that its memory rules should have refused.

The public descriptions set a limit on what we can honestly claim. The vulnerability record says a remote attacker could use a crafted HTML page to run code **inside Chrome’s sandbox**, the fenced area meant to limit what a web page can reach. Google has not publicly described who used the exploit, whom they targeted, which sites delivered it, or whether it was paired with another flaw. As of 15 September 2026, a statement that every visitor could lose control of the whole computer would go beyond the evidence.

The repair still deserves prompt attention. On 9 September, the US Cybersecurity and Infrastructure Security Agency added CVE-2026-87491 to its Known Exploited Vulnerabilities catalogue. That catalogue entry says the weakness can affect several browsers built on Chromium, including Chrome, Microsoft Edge, and Opera, and gives US federal agencies a 23 September deadline under the agency’s current update rules ([CISA: Known Exploited Vulnerabilities catalogue](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)). A federal deadline does not become a household deadline, but the entry confirms the practical fact that exploitation is more than a laboratory possibility.

You may also see clashing severity labels. Google listed this particular flaw as Medium in its release notes, while some news reports called it High. BleepingComputer confirmed the same fixed Chrome versions and Google’s exploitation statement, but used the higher label in its account ([BleepingComputer: Google warns of new Chrome zero-day bug exploited in attacks](https://www.bleepingcomputer.com/news/security/google-patches-seventh-chrome-zero-day-exploited-in-attacks-this-year/)). That disagreement is a poor use of your attention. A suitable fix exists, the software is exposed to web content every day, and both Google and CISA say the flaw has been used. Update the browser, then get on with your life.

## Why “Chrome Updates Automatically” Is Only Half the Story

Chrome’s automatic updater does useful work in the background. It checks for a newer release, downloads one when available, and prepares it without asking you to hunt for an installer. Google’s desktop help page says Chrome normally applies the update when the browser closes and reopens. Visiting **Help**, then **About Google Chrome**, also makes the browser check and shows whether a relaunch is waiting ([Google Chrome Help: Update Google Chrome](https://support.google.com/chrome/answer/95414?hl=en&co=GENIE.Platform=Desktop)).

The awkward part is that many of us rarely close a browser. A laptop lid comes down at night, the machine sleeps, and forty tabs return in the morning. The same browser process may keep going for days. Chrome can have the repaired files ready on disk while the older program remains in memory until a proper relaunch.

Here is how that plays out in an ordinary home. Maya uses a family laptop for work, school messages, and shopping. Chrome downloads an update on Tuesday afternoon, but Maya leaves a form open and closes the lid. Wednesday morning looks normal because every tab has survived. The update badge is easy to miss, and the browser keeps serving the old session until she chooses Relaunch or closes every Chrome window and opens it again.

A browser restart is usually gentle. Chrome normally offers to restore regular tabs and windows, although private browsing tabs will not return and an unfinished form may lose its contents. Save the form, finish the payment, or copy the text you care about first. A two-minute pause at a sensible moment beats postponing the relaunch for a week because one tab feels too precious to disturb.

There is another quiet gap between “the update exists” and “my machine has it.” Google said Chrome 153 would roll out over the following days and weeks. Staged releases are common because vendors watch for problems rather than sending a change to every machine at the same second. Opening the About page asks the browser to check its own update channel now; guessing from the date on a news story cannot tell you what your copy has received.

This is why the About page works like a receipt. A notification says work is available. A download says files arrived. A version shown after relaunch says which program is now running. Security advice becomes much less mysterious when you ask for that last piece of evidence.

## What “Exploited in the Wild” Does and Does Not Tell You

The phrase sounds dramatic because it is deliberately compact. In security reporting, “exploited in the wild” means there is evidence that somebody used the weakness against real systems rather than only demonstrating it under controlled conditions. Google’s release note makes that narrow statement. CISA’s catalogue independently records known exploitation. Neither source, as of 15 September, describes a broad campaign aimed at every Chrome user.

That distinction protects you from two bad responses. Panic is one. A family sees the phrase “zero-day,” assumes every account has already been stolen, and starts changing dozens of passwords on the same browser before applying the available repair. Complacency is the other. Someone notices that Google called the flaw Medium, decides the warning can wait, and leaves an exposed browser open because only a Critical label feels serious.

The calm middle is better. A zero-day is simply a vulnerability that attackers could use before users had a fix available, or before the vendor had publicly repaired it. The useful date changed on 8 September when Google released fixed desktop versions. From that point, the question for you became less about the attacker’s identity and more about whether your browser had crossed from the old build to the repaired one.

Google limits technical detail while updates spread. Its release notice explains that bug links may remain restricted until most users have a fix, especially when a third-party library could leave other projects exposed. That restraint makes sense, but it also creates a vacuum in which confident guesses flourish. Treat precise claims about the victims, delivery method, or complete attack chain cautiously unless Google or another source with direct evidence publishes them.

A browser sandbox also deserves a plain explanation. Web pages run inside a room with locked internal doors. A flaw inside that room may let an attacker rearrange more than the browser intended, yet reaching the rest of the computer can require another weakness that opens an outer door. The public CVE description places code execution inside the sandbox. That is serious enough to repair without pretending the public record proves a full escape from it.

Updating after known exploitation does not certify that nothing happened before the update. It closes the published weakness for future browsing on that fixed version. For a normal home user with no sign of trouble, the sensible response stops there: update, relaunch, and continue. If you have separate evidence such as an antivirus alert, an unfamiliar extension, unexpected account sessions, or software you did not install, follow that evidence with a device scan and account checks instead of treating the CVE headline itself as proof of compromise.

## The Three States of a Browser Update

A browser update passes through three everyday states, and the labels around them can blur together. First, an update is **offered**. The vendor has published it, perhaps with a gradual rollout. Second, it is **downloaded**. The new files are present, but the old browser process may still be active. Third, it is **running**. Chrome has relaunched into the new build, and the About page reports that build.

People often stop at the first state because the headline says Google has fixed the bug. That sentence describes Google’s release, not your laptop. Others stop at the second because Chrome displays “Nearly up to date” or asks for a relaunch. The repair reaches your browsing session only at the third state.

The version numbers in Google’s 8 September desktop announcement provide a dated reference point. The fixed stable release was Chrome **153.0.8010.36 for Linux** and **153.0.8010.36 or .37 for Windows and macOS**. BleepingComputer reported the same platform versions on 9 September. Chrome may have moved to a later build by the time you read this, and a later stable version should include the earlier repair, so do not try to force the number backwards to match an article.

That last detail prevents a common mistake. Someone sees .36 in a warning, finds .42 on the computer, and wonders whether the numbers disagree. Software versions move forward. A higher current Chrome 153 build, or a later major version supplied through the stable channel, is normally the better receipt. The About page’s “Chrome is up to date” message matters alongside the version because it reflects the channel available to that device at that moment.

Managed computers add one more state: **approved by whoever runs the device**. A workplace or school can control the browser channel, delay updates for testing, or require administrator rights. If the About page says updates are disabled by an administrator, the useful action is to send the exact message and version to the support desk. Repeatedly downloading installers may fight company controls without fixing the managed copy you actually launch.

Old operating systems can also stop receiving current browser releases. In that case the About page may say Chrome is current even though the machine is current only for an unsupported platform. Read the whole message. If Google says the operating system can no longer receive Chrome updates, the durable repair is an operating-system upgrade or a supported device, not a browser extension that promises extra protection.

## Check the Browser You Actually Open

Many households have more than one browser without meaning to. Windows includes Edge, someone installed Chrome for work, a meeting link opens another app, and an email shortcut chooses whichever browser is set as the default. Updating one icon does not update every browser engine on the machine.

CISA’s 9 September entry explicitly says CVE-2026-87491 could affect multiple browsers that use Chromium, including Chrome, Edge, and Opera. Chromium is the shared foundation under several browser brands. Each maker packages that foundation and ships updates on its own schedule. Chrome’s version receipt therefore cannot prove that Edge, Opera, Brave, or Vivaldi has received its corresponding repair.

Start with the browser you use for email, banking, shopping, and day-to-day links. In Chrome, open the three-dot menu, choose **Help**, then **About Google Chrome**. Let the check finish, relaunch if asked, and return to the page. You can also type `chrome://settings/help` in the address bar, although using the menu is easier to remember and less prone to typing errors.

If you use Edge, open its three-dot menu, choose **Help and feedback**, then **About Microsoft Edge**. Microsoft says Edge checks and installs updates on that page and may ask for a restart to complete them ([Microsoft Support: Getting the latest Microsoft Edge update](https://support.microsoft.com/en-us/edge/getting-the-latest-microsoft-edge-update-just-got-easier)). The exact Edge build will differ from Chrome’s. Let Edge judge its own current release rather than comparing two unlike version labels.

For another Chromium-based browser, use that browser’s About or Update page and look for the maker’s confirmation. The Hacker News advised users of Edge, Brave, Opera, and Vivaldi to apply their vendor updates as those became available ([The Hacker News: Chrome V8 zero-day exploited in the wild](https://thehackernews.com/2026/09/chrome-v8-zero-day-exploited-in-wild.html)). As of 15 September, do not assume shared code means every brand shipped on Google’s exact timetable.

Firefox and Safari use different browser engines, so this specific V8 flaw does not map to them in the same way. They still need their own updates. If Firefox or Safari is what you actually open, check that product’s update status and ignore Chrome-specific version numbers. The goal is current software, not loyalty to a particular logo.

Phone and tablet browsers complicate the picture because app stores manage much of the update process. Check the device’s app store for pending browser updates and install the current system update when offered. The 8 September Google source used here is specifically the Chrome **desktop** stable-channel notice, so I am not using its desktop build number as proof for Android or iPhone. Each device should show its own current app and operating-system state.

## What to Do on a Shared Family Computer

A family computer turns a five-minute job into a coordination problem. One person leaves work tabs open, another uses a separate login, and a child has a school browser managed by the school. The answer is not a household audit with clipboards. Pick the main computer, save unfinished work, and give each browser a clean restart.

Begin with the person who owns the open tabs. Ask them to submit unfinished forms, save drafts, and note any private tabs they need because those will not be restored. Chrome’s update help says open tabs and windows return after relaunch in the ordinary case. That makes the restart far less disruptive than closing each page by hand.

Next, check separate operating-system accounts if the family uses them. The Chrome program may update for the whole machine, but each person can leave a running browser session open under their own account. Sign out or restart the computer after everyone saves their work. A full computer restart is a simple way to make stale browser processes let go, and it also completes any operating-system update waiting for the same courtesy.

Look at rarely used machines too, but keep the task proportionate. The laptop used daily for email and money comes first. The spare laptop that has been switched off for two months can wait until the next time someone intends to use it, provided the first action then is to update before browsing. A dead device in a drawer cannot visit a malicious page.

Shared devices often collect duplicate browser profiles and extensions. This week’s Chrome repair does not require you to remove every extension or reset every password. Still, the About-page visit is a good moment to notice an extension warning, an unexpected browser, or a message saying updates are controlled by an organisation you do not recognise. Those are concrete signals worth following. A generic zero-day headline is not.

If a relative needs help, avoid asking them to read you a long version number over the phone. Ask them to share their screen or send a photo of the About page after the relaunch. You are looking for the browser’s up-to-date message and the absence of an unresolved error. One clear receipt is kinder than a ten-minute recital of menus and security vocabulary.

## What Does Not Help Much

Closing the suspicious-looking tab you happen to notice is not a substitute for the update. Google has not identified a particular public site in its announcement, and a crafted page can look entirely ordinary. Judging a page by its colours, spelling, or padlock icon cannot tell you whether it contains code that reaches this memory flaw.

Clearing cookies and browsing history does a different job. Cookies remember sessions and preferences; history records where you went. Removing them can sign you out, but it does not replace the browser program or apply a waiting code repair. Keep your cookies unless you have another reason to clear them.

Changing every password before updating also puts the work in the wrong order. Public reporting does not establish that this flaw stole your passwords, and entering fresh passwords through an older browser does nothing to close the weakness. Apply the update first. Change a password when an account provider reports exposure, you see an unfamiliar login, you reused a known compromised password, or another piece of evidence gives you a reason.

Buying a security product cannot make an outdated browser current. Antivirus and built-in protections can catch some malicious behaviour, which is useful, but they do not rewrite Chrome’s V8 engine. The browser vendor’s update repairs the specific faulty code. Add-on promises about “military-grade browsing” are especially easy to sell when a zero-day is in the news and especially poor evidence that the underlying program has changed.

You also do not need to uninstall Chrome merely because the flaw existed. Reinstalling may eventually produce a current copy, but it can cost saved settings and still leaves room to download the wrong installer from an advertisement. Use the built-in update page first. If the update repeatedly fails, follow Google’s official update troubleshooting or ask someone you trust for help.

Finally, do not turn off JavaScript as a permanent household cure unless you understand the trade. The flaw is in the engine that runs web code, but disabling scripts can break banking, shopping, webmail, maps, and accessibility features, and it does not replace a vendor fix. The available update is the cleaner answer for ordinary use.

## A Five-Minute Receipt You Can Keep

The practical sequence is short enough to do before your next cup of tea goes cold. It aims to prove the browser now running, rather than prove you saw a warning.

1. **Save unfinished work.** Submit forms, copy unsent text, and note any private tabs you still need. Ordinary tabs usually return after Chrome relaunches, but private ones do not deserve that assumption.

2. **Open the About page.** In Chrome, choose the three-dot menu, **Help**, then **About Google Chrome**. Wait while the page checks. Avoid downloading an “update” from a pop-up or search advertisement.

3. **Relaunch when asked.** Press the browser’s **Relaunch** button. If no button appears but the page says the update will finish when Chrome restarts, close every Chrome window and open it again.

4. **Return for the receipt.** Open **About Google Chrome** a second time. As of Google’s 8 September release, the repaired desktop baseline was 153.0.8010.36 on Linux and 153.0.8010.36 or .37 on Windows and macOS. A later stable build is expected to be higher. Look for the up-to-date message as well as the number.

5. **Check the other browser you genuinely use.** If daily links open in Edge or another Chromium-based browser, visit that browser’s own About page. Its maker controls its version and release timing.

6. **Restart the computer if sessions linger.** This is especially useful on a shared machine or one that sleeps for weeks. Save everyone’s work first, then let a full restart clear old browser processes.

7. **Escalate an actual error.** If updates are disabled, the system is unsupported, or the same update fails repeatedly, record the exact message and ask the device administrator or a trusted helper. If you also see unfamiliar logins, extensions, alerts, or installed programs, preserve those details and investigate that evidence separately.

You can keep the receipt as a screenshot if you manage a parent’s computer or a small office. Include the date, browser name, About-page message, and visible version. There is no need to collect browsing history, passwords, or personal tabs. The record should prove maintenance without becoming a new pile of sensitive information.

For a small business, a simple device list is enough: computer name, regular user, browser, check date, result, and any error handed to support. The value comes from finding the forgotten reception laptop or meeting-room computer, not from producing a polished report. If the list becomes harder than the update, simplify it.

## The Better Habit Is a Monthly Restart, Not Daily Alarm

Chrome has patched several exploited vulnerabilities during 2026, and the count makes an easy headline. It does not mean a family should follow every CVE feed. Browser makers release repairs precisely because maintaining the engine is their job. Your part is to leave automatic updates enabled and make enough room for them to finish.

A monthly computer restart is a useful household habit for machines that otherwise only sleep. It gives browsers, the operating system, and background services a clean transition into files they have already downloaded. When a vendor announces a flaw already used in attacks, bring that restart forward and check the About page rather than waiting for the monthly date.

The same habit works for relatives who do not want security news. Put a recurring reminder beside another ordinary task: the first bill-paying day of the month, the day photos are backed up, or the weekend the smoke-alarm light gets a glance. Open the main browser’s About page, restart if needed, and stop when it reports current. Ten quiet minutes each month is more dependable than a burst of anxious work after a dramatic headline.

This approach also leaves room for updates that are genuinely disruptive. Save work first. Let the browser restore normal tabs. If a work or school administrator controls the machine, hand them the error rather than fighting it. Safety that fits into real life gets done; a perfect ritual that ruins the afternoon gets postponed.

The useful lesson from CVE-2026-87491 is smaller than the name suggests. Google shipped the repair on 8 September, exploitation was confirmed, and a downloaded update may still be waiting behind one open browser session. Close that gap. Relaunch, check the receipt, and give yourself permission to ignore the rest of the alphabet soup.

For more calm, practical security advice, join the Cyber Security in Plain English newsletter. One email per month, and no panic in your inbox.

## Sources

- [Google Chrome Releases: Stable Channel Update for Desktop](https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html), accessed 2026-09-15
- [CISA: Known Exploited Vulnerabilities catalogue](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json), accessed 2026-09-15
- [NVD: CVE-2026-87491](https://nvd.nist.gov/vuln/detail/CVE-2026-87491), accessed 2026-09-15
- [BleepingComputer: Google warns of new Chrome zero-day bug exploited in attacks](https://www.bleepingcomputer.com/news/security/google-patches-seventh-chrome-zero-day-exploited-in-attacks-this-year/), accessed 2026-09-15
- [Google Chrome Help: Update Google Chrome](https://support.google.com/chrome/answer/95414?hl=en&co=GENIE.Platform=Desktop), accessed 2026-09-15
- [Microsoft Support: Getting the latest Microsoft Edge update](https://support.microsoft.com/en-us/edge/getting-the-latest-microsoft-edge-update-just-got-easier), accessed 2026-09-15
- [The Hacker News: Chrome V8 zero-day exploited in the wild](https://thehackernews.com/2026/09/chrome-v8-zero-day-exploited-in-wild.html), accessed 2026-09-15

---

## About the author

Kubilay Tunca — Senior Full Stack Developer and Author. Founded Cyber Security in Plain English to translate complex security concepts into clear, practical advice, and writes the accompanying books on security, privacy, secure development, and AI systems.

## Books by this author

- **The Digital Fortress** — Your Everyday Guide to a Safer Digital Life. A warm, plain-English guide for people with real lives and finite patience. Learn the handful of habits that genuinely protect your money, accounts, and family, and get honest permission to ignore the rest. [Amazon](https://buy.cyber-security-in-plain-english.com/digital-fortress) · [Details](https://cyber-security-in-plain-english.com/books/the-digital-fortress)
- **The Anonymity Playbook** — Digital Survival for Whistleblowers, Journalists, Activists, and Everyone Else. A practitioner’s field manual for journalists protecting sources, whistleblowers, and activists. It explains how the surveillance actually works, what each technique costs you, and exactly where it fails. [Amazon](https://buy.cyber-security-in-plain-english.com/anonymity-playbook) · [Details](https://cyber-security-in-plain-english.com/books/the-anonymity-playbook)
- **Secure Software Development** — Practical patterns for building secure software. A hands-on security guide for developers and IT professionals who ship real software. Build, deploy, and maintain secure systems without slowing down or drowning in theory. [Amazon](https://buy.cyber-security-in-plain-english.com/secure-software-development) · [Details](https://cyber-security-in-plain-english.com/books/secure-software-development)
- **The Secure Harness** — Shipping Production Code with AI Coding Agents. A calm, practical guide to letting agents do useful work inside boundaries you set, enforce, and audit. Ships with 15 copy-pasteable artifacts: hook scripts, permission configs, release gates, and MCP templates. [Amazon](https://buy.cyber-security-in-plain-english.com/secure-harness) · [Details](https://cyber-security-in-plain-english.com/books/the-secure-harness)
- **The AI Native Engineer** — Build, Evaluate, and Ship AI Systems That Work in Production. Sixteen hands-on chapters, one real product. Grow it from a single model call into a retrieved, tool-using, observable, production-grade system, with evaluation treated as a habit from the first feature. [Amazon](https://buy.cyber-security-in-plain-english.com/ai-native-engineer) · [Details](https://cyber-security-in-plain-english.com/books/the-ai-native-engineer)

Full catalogue with contents and intended audience: https://cyber-security-in-plain-english.com/books

_As an Amazon Associate I earn from qualifying purchases. Buying through these links costs you nothing extra and helps pay for the blog._