Chrome 153 Starts Two-Week Release Cycle with 230 Security Fixes and an Exploited V8 Flaw

Chrome 153 entered the Stable channel on 8 September 2026, starting Google's new two-week major release cadence. In its Stable Channel Update for Desktop, Google lists 230 security fixes and says an exploit for CVE-2026-87491 exists in the wild. The release is rolling out to Windows, macOS, and Linux, with a corresponding Android build also released.

The faster cadence shortens the interval between Chrome major versions tracked by Drupal's rolling browser-support policy. Drupal guarantees the latest release of each of the latest two supported Chrome major versions on desktop, while Chrome for Android is supported at the latest supported release of its latest major version. With Chrome majors now arriving every two weeks instead of every four, the supported desktop window can advance more frequently. Drupal's published platform requirements for Drupal 12 leave that browser policy unchanged.

The Chrome 153 security list includes five vulnerabilities classified as Critical, four in WebGL and one in Cast. The WebGL findings include two use-after-free flaws, an out-of-bounds write, and a buffer overflow, while the Cast finding is another use-after-free issue. Separately, Google classifies CVE-2026-87491, an out-of-bounds write in the V8 JavaScript engine, as Medium severity. Google reports active exploitation for that V8 vulnerability in the Chrome 153 release notice.

Desktop builds are 153.0.8010.36 for Linux and 153.0.8010.36/.37 for Windows and macOS. Android received 153.0.8010.36. Google says Android releases contain the same security fixes as their corresponding desktop releases unless otherwise noted. The company says the Stable rollout will continue over the coming days and weeks.

Chrome 153 is the first Stable milestone under the two-week release schedule Google announced earlier in 2026. Stable releases previously followed a four-week cadence introduced in 2021. Chrome 154 Stable is scheduled for 22 September 2026, while Extended Stable continues to receive major feature milestones every eight weeks. Google says security fixes will continue to be backported to Extended Stable on the regular weekly schedule.

For Drupal teams, the practical issue is the shorter interval available for testing browser-dependent behaviour across administrative interfaces, contributed JavaScript, themes, accessibility tooling, and integrations. The change is also relevant to Drupal Canvas, where site builders work through browser-based interfaces. Google recommends testing sites against Chrome Beta before Stable releases, giving teams an earlier point to identify potential regressions as the Stable cadence accelerates. The available sources do not identify a Chrome 153-specific regression affecting Drupal or Canvas, so the Drupal significance is the faster testing and support cycle rather than a demonstrated compatibility problem.