A Chrome Zero-Day Is Being Exploited Right Now — Can Your RMM Name Every Endpoint Still Running the Vulnerable Build?

Google just shipped Chrome 153 with fixes for 230 vulnerabilities. One of them — CVE-2026-87491, a flaw in the V8 JavaScript engine — has already been observed in active attacks, making it the seventh Chrome zero-day of 2026. And it's not even an unusual year. V8 bugs like this one are the classic entry point for drive-by compromise: a user clicks a link, a hostile page triggers the flaw, and the payload lands without a download prompt, a UAC dialog, or anything else your endpoint stack would normally catch.

The remediation target is concrete: Chrome 153.0.8010.36 or 153.0.8010.37, depending on the operating system, on every managed endpoint.

So here is the question that separates teams that have their act together from teams that don't: right now, without walking the floor or emailing users, can you produce an accurate, device-level list of every machine still running a vulnerable Chrome build? Not we enable auto-updates. An actual list.

If the honest answer is no, keep reading. This is fundamentally an RMM problem, and most toolchains handle it badly.

Why Chrome Auto-Updates Alone Fails in the Real World

Chrome updates itself, yes. That sentence has lulled entire IT departments into a false sense of compliance. Three specific gaps turn the auto-updater from a safety net into a liability.

The relaunch gap: installed is not running. Even when Google Update successfully downloads and installs the new build, chrome.exe keeps executing the old binary until the browser restarts. Your finance manager who hasn't closed Chrome in twelve days is running a known-exploited V8 build right now, even though the patched binary has been sitting on disk for a week. Any verification based on installed-software inventory alone will report that machine as patched. It isn't. This single detail is where most we're compliant claims fall apart.

Per-user installs, VDI images, and kiosks. Chrome can install per-user under %LOCALAPPDATA%, invisible to machine-level software queries and to anyone who only checks HKLM. VDI golden images, conference room PCs, and shared kiosks often have their updater services disabled for change control reasons and nobody ever re-enables them. If your patch reporting only covers machine-wide installs, you have a blind spot — and it is exactly the kind of machine that multiple users share.

Tool sprawl turns a ten-minute job into a two-day fire drill. Walk through what actually happens in most shops when news like this drops. The monitoring platform — PRTG, Zabbix, Datadog, pick one — has no idea what software is on a desktop; it watches servers and services. The RMM can run scripts, but it lives in a separate console, and for an MSP, a separate console per client. The patch management tool handles Windows updates but often not third-party browsers. The helpdesk knows nothing until someone opens a ticket. So a tech reads the news, posts everyone check your Chrome version in Slack, writes a PowerShell one-liner, runs it client by client, exports CSVs, does a VLOOKUP against the version list, emails clients, and hopes. For an MSP with 40 clients and 2,500 endpoints, that is one to two full working days of a senior tech's time — during which the exposure window stays open.

And when the CIO or the client asks for proof that CVE-2026-87491 was remediated within the 24-hour SLA window, the evidence is a folder of CSVs and a shrug.

How AlertMonitor Turns This Into a 15-Minute Job

AlertMonitor combines infrastructure monitoring, RMM, patch management, and helpdesk in one platform, and this scenario is precisely where that architecture pays off.

Live, agent-reported software and process inventory. Every endpoint reports installed applications and running process versions continuously. Open the device view, filter by Google Chrome below version 153.0.8010.36, and get the actual list of vulnerable machines in seconds — including per-user installs, and including machines where the patch is installed but the old binary is still running.

Script execution against device groups, with results in the timeline. Save the version-check script once, select a device group — All Windows Endpoints or a single client's scope — and run it. Results come back per device and land on the same timeline as the monitoring data. No CSV export, no console hopping per client, no spreadsheet archaeology.

Automation instead of heroics. Because script results feed back into the monitoring data, you can turn this into a standing rule: if any endpoint reports a Chrome version below the safe build, raise an alert, automatically run the update script, and verify. The next zero-day stops being a fire drill and becomes a Tuesday-morning report that generated itself.

Helpdesk evidence, not anecdotes. Open one ticket for the CVE, link it to the affected devices, and let the timeline show scope, remediation, and verification. That's your SLA report. It takes zero extra work because the data was collected as a byproduct of fixing the problem.

The old way: five tools, two days, no proof. The AlertMonitor way: one console, one script, one timeline, verifiable compliance before lunch.

Practical Steps: Verify and Force-Patch Chrome 153 Today

These scripts assume Windows endpoints with Chrome installed under Program Files; adapt the paths for per-user installs. Run them via your RMM — or via AlertMonitor's script engine, where the output lands directly on each device's timeline.

1. Enumerate every Chrome installation, including per-user installs:

# Enumerate every Chrome installation: machine-wide AND per-user
$uninstallPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

Get-ItemProperty -Path $uninstallPaths -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -eq 'Google Chrome' } |
    Select-Object DisplayName, DisplayVersion, InstallLocation |
    Format-Table -AutoSize

2. Find machines where the patch is installed but the old binary is still running:

# Compare the RUNNING Chrome binary to the INSTALLED one.
# A mismatch means the fix is on disk but the user is still browsing on the old build.
$chromeExe = Join-Path $env:ProgramFiles 'Google\Chrome\Application\chrome.exe'

$installed = if (Test-Path $chromeExe) {
    (Get-Item $chromeExe).VersionInfo.ProductVersion
} else { 'not installed' }

$proc = Get-Process chrome -ErrorAction SilentlyContinue | Select-Object -First 1
$running = if ($proc) { (Get-Item $proc.Path).VersionInfo.ProductVersion } else { 'not running' }

[PSCustomObject]@{
    Computer            = $env:COMPUTERNAME
    InstalledVersion    = $installed
    RunningVersion      = $running
    PatchPendingRestart = ($running -ne 'not running' -and $running -ne $installed)
}

3. Force the update and stage a controlled relaunch:

# Force Google Update to apply the latest Chrome build, then relaunch safely
$gUpdate = Join-Path $env:ProgramFiles 'Google\Update\GoogleUpdate.exe'
$chrome  = Join-Path $env:ProgramFiles 'Google\Chrome\Application\chrome.exe'

if (Test-Path $gUpdate) {
    Start-Process $gUpdate -ArgumentList '/ua /installsource scheduler' -Wait
}

# Only restart the browser if it is running, and warn users first
if (Get-Process chrome -ErrorAction SilentlyContinue) {
    msg * 'IT: Chrome is being patched for an actively exploited flaw (CVE-2026-87491). Chrome restarts in 5 minutes - please save your work.'
    Start-Sleep -Seconds 300
    Stop-Process -Name chrome -Force -ErrorAction SilentlyContinue
    Start-Sleep -Seconds 5
    Start-Process $chrome -ArgumentList '--restore-last-session'
}

4. Mixed fleet? Linux endpoints take one line:

# Report the installed Chrome/Chromium build on a Linux endpoint
google-chrome --version 2>/dev/null || chromium --version 2>/dev/null || echo 'chrome not installed'

5. Wire it into AlertMonitor as standing automation:

• Save the version-check script as a reusable script component.
• Create an automation rule: when the asset report shows Google Chrome below 153.0.8010.36, raise a medium-priority alert on the device and auto-run the update script.
• Script output lands on the device timeline — scope, action, and verification are all in one record.
• Attach the affected devices to a single helpdesk ticket for the CVE so the SLA clock and the evidence trail live in the same place.
• For the handful of endpoints that need a human touch — a kiosk that can't restart mid-day, a VDI image that needs rebuilding — open a remote session straight from the device view. No second tool, no credential juggling.

The Takeaway

Seven Chrome zero-days in 2026. At this cadence, check the fleet and patch is not an event; it is a recurring workload, and it will keep landing on your worst possible week. Teams on a unified platform absorb it: inventory is current, the script is saved, the automation fires, the ticket closes itself with evidence attached. Teams running five disconnected consoles absorb it too — in overtime, CSV files, and a compliance report nobody fully trusts.

The next zero-day is not a question of if. The only question is whether finding your vulnerable endpoints takes fifteen minutes or two days.

Related Resources

AlertMonitor RMM & Remote Management AlertMonitor Platform Overview Book a Demo RMM & Remote Management Resources