Google Patches Actively Exploited Chrome V8 Zero-Day

Google has released a Chrome update that fixes CVE-2026-87491, an actively exploited Chrome V8 zero-day that lets a remote attacker run arbitrary code inside the browser sandbox by getting a victim to open a specially crafted HTML page. The flaw is an out-of-bounds write in V8, the component of Chrome that runs JavaScript and WebAssembly code. An out-of-bounds write means the program writes data outside the memory location it is supposed to use, which can corrupt memory and let an attacker take control of part of the browser. A zero-day is a vulnerability that attackers started using before the software maker had a fix available, so there was no patch on the day the bug was first exploited.

The update, released on Tuesday, patches 230 security vulnerabilities in total. The entry for CVE-2026-87491 on the NIST National Vulnerability Database says that in Chrome versions before 153.0.8010.36, the bug allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chrome's sandbox is a security boundary that keeps web page code separated from the rest of the computer; code that runs inside the sandbox has limited access, but attackers can still use it as a first step toward further compromise. Google has rated the flaw as medium severity and has not published a CVSS score, but active exploitation in the wild makes it urgent.

Security researcher Jihyeon Jeong of Compsec Lab at Seoul National University discovered and reported the flaw to Google on August 6, 2026. Jeong received a $2,500 bug bounty reward for responsible disclosure. Google says it is aware that an exploit for CVE-2026-87491 exists in the wild, but has not shared further details about how attackers are using it or who is behind the attacks. The company also says access to bug details and links may remain restricted until most users have installed the fix, or if the bug exists in a third party library that other projects depend on but have not yet patched.

With this release, Google has now addressed seven actively exploited Chrome zero-days since the start of the year. The earlier six are CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, and CVE-2026-85046. In the same update, Google also fixed five critical security flaws in WebGL and Cast components. WebGL is used by web pages to draw 3D graphics in the browser, and Cast handles streaming to devices like Chromecast. The critical fixes are CVE-2026-87464 and CVE-2026-87488, both use-after-free bugs in WebGL; CVE-2026-87438, an out-of-bounds write in WebGL; CVE-2026-87527, a buffer overflow in WebGL; and CVE-2026-87628, a use-after-free bug in Cast. Google says it reported 195 of the 230 flaws fixed in this update. One high severity use-after-free flaw in WebPackaging, CVE-2026-87639, is credited to OpenAI Codex Security. Use-after-free means the program continues to use a memory area after it has been released, which can also let an attacker corrupt memory and run code. Google also noted that many of its security bugs are detected with automated tools such as AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL.

To get the fix, users should update Chrome to version 153.0.8010.36 or .37 on Windows and Apple macOS, and to 153.0.8010.36 on Linux. The simplest way is to open Chrome, click the three-dot menu, choose Help, then About Google Chrome. The browser will check for the update and show a Relaunch button, which restarts Chrome with the patched version. Users of other Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi should apply the fixes as those vendors release them, because these browsers share much of the same underlying code. Chrome normally updates automatically in the background, but if the browser has been open for a long time, the update may wait for a relaunch, so checking manually makes sure the fixed version is active.

On September 9, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-87491 to its Known Exploited Vulnerabilities catalog. That catalog lists vulnerabilities that CISA says are actively being exploited and must be patched promptly. CISA requires Federal Civilian Executive Branch agencies, which include civilian government departments, to apply the patch by September 23, 2026. For everyone else, that date is a useful practical target: if a browser bug is on a government watchlist because it is being used in real attacks, individual users and businesses should treat it with the same urgency.

For website owners and IT teams, this is another reminder that browser patching is not optional. An outdated browser can be the entry point that lets an attacker reach a WordPress admin panel, a hosted control panel, or a cloud dashboard. AEU Hosting, our managed WordPress hosting service, keeps the server side patched and monitored, but the person at the keyboard still needs to run the current version of Chrome on every device used to access those systems. A fully patched server behind an outdated browser still leaves a door open, and the fix for this Chrome V8 zero-day closes that door on the user side.