- The Mess: Google just patched another Chrome zero-day in V8, and attackers were already using it before the fix landed. A crafted HTML page can trigger memory corruption inside Chrome’s JavaScript engine.
- The Damage: CVE-2026-87491 can give a remote attacker arbitrary code execution inside Chrome’s sandbox simply by getting a victim to process malicious web content.
- The Fix: Update Chrome to 153.0.8010.36/.37 on Windows and macOS or 153.0.8010.36 on Linux immediately.
Chrome just got another emergency security upgrade.
Google patched 230 vulnerabilities in Chrome 153. Buried inside that enormous number is the one defenders should care about most: CVE-2026-87491, an actively exploited zero-day in the V8 JavaScript and WebAssembly engine.
Google explicitly says an exploit for the vulnerability exists in the wild.
That is enough to move it straight to the top of the patch queue.
V8 is the target
CVE-2026-87491 is an out-of-bounds write in V8.
The vulnerable code can write data outside the memory region it was supposed to control. NVD describes the impact as remote code execution inside the Chrome sandbox through a specially crafted HTML page.
The attack doesn’t require the victim to download an executable.
The malicious code can arrive as ordinary web content.
A compromised website, malicious advertisement, phishing page or deliberately crafted URL can become the delivery mechanism.
The browser does the rest.
The sandbox is doing its job — until it isn’t
There is an important distinction here.
Google’s public description says arbitrary code execution occurs inside the sandbox.
That does not mean the vulnerability is harmless.
The Chrome sandbox is supposed to contain compromised renderer processes. Browser exploitation therefore often happens in stages: first obtain execution inside the renderer, then find another weakness that escapes the sandbox.
CVE-2026-87491 provides the first part.
Whether attackers are chaining it with a sandbox escape in the current campaign has not been publicly disclosed by Google. The company is deliberately restricting technical details while the patch rolls out.
So we know exploitation is real.
We don’t yet know the complete chain.
Why out-of-bounds writes are nasty
An out-of-bounds write gives an attacker something browsers really don’t want to hand over: corrupted memory.
At a high level, the attacker tries to turn that corruption into a reliable primitive — controlling data, references or execution flow that V8 normally keeps under strict rules.
The exact exploitation technique for CVE-2026-87491 isn’t public yet.
That is deliberate.
Google has restricted access to bug details and links until a majority of users have had time to update.
For defenders, that creates an uncomfortable situation:
The exploit exists, but the exploit details don’t.
Patch first.
Reverse-engineer later.
Chrome 153 is the line
Google fixed the vulnerability in:
- Chrome 153.0.8010.36 — Linux
- Chrome 153.0.8010.36 / .37 — Windows and macOS
The update also fixes five critical vulnerabilities and dozens of high-severity issues across Chrome components.
Checking the installed version matters because Chrome’s update mechanism can download a fix without immediately replacing the browser process currently running.
Restart Chrome after the update.
Enterprise administrators should also check managed endpoints, VDI images and machines that rarely restart.
This is Chrome’s seventh exploited zero-day of 2026
CVE-2026-87491 is not an isolated incident.
Google has now patched seven Chrome zero-days exploited in the wild during 2026.
The previous six include:
- CVE-2026-2441
- CVE-2026-3909
- CVE-2026-3910
- CVE-2026-5281
- CVE-2026-11645
- CVE-2026-85046
The last one, CVE-2026-85046, was patched only days ago.
Now V8 has another actively exploited memory-corruption bug.
That’s the pattern worth watching.
Browser security isn’t about finding one bad bug and declaring victory after Patch Tuesday.
The attack surface keeps moving.
Chromium derivatives need attention too
Chrome isn’t the only browser that matters.
V8 is part of the broader Chromium ecosystem, so organizations using Chromium-based products should verify whether their vendors have incorporated the corresponding security fixes.
That includes products built around Chromium or embedded Chromium runtimes.
Don’t assume that updating Chrome automatically patches every Chromium component on the network.
It doesn’t.
Bugstoday Opinion
Another Chrome zero-day.
Another V8 memory-corruption bug.
Another confirmation that attackers don’t need a spectacular phishing campaign when a browser can turn a web page into an exploitation surface.
The most interesting number isn’t 230 vulnerabilities.
It’s seven exploited Chrome zero-days in 2026.
And CVE-2026-87491 is number seven.
Update Chrome. Restart it. Then check what other Chromium-based software your organization forgot about.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- Google Chrome Releases — Chrome 153 security update
- NIST NVD — CVE-2026-87491
- Help Net Security — CVE-2026-87491 analysis
- BleepingComputer — Chrome zero-day exploitation report
- SecurityWeek — Chrome 153 security release
