Google Patches Actively Exploited Chrome V8 Zero-Day CVE-2026-87491

A newly disclosed Google Chrome zero-day vulnerability in the browser’s V8 engine is under active exploitation in the wild, prompting Google to issue emergency updates across Windows, macOS, and Linux. Tracked as CVE-2026-87491, the flaw allows remote attackers to achieve arbitrary code execution inside Chrome’s renderer sandbox simply by convincing a target to load a crafted HTML page.

The security update arrives as part of a massive maintenance release addressing 230 vulnerabilities. It represents the seventh zero-day flaw in Chrome addressed by Google since the start of the year, underscoring continued threat actor focus on client-side memory corruption in modern web browsers.

Understanding the V8 Sandbox Flaw (CVE-2026-87491)

The underlying issue is categorized as an out-of-bounds write (CWE-787) within V8, Chrome’s open-source JavaScript and WebAssembly engine. In modern browser architectures, V8 is responsible for compiling and executing complex web scripts at near-native speeds. To achieve high performance, engines use Just-In-Time (JIT) compilation and heavy memory optimization, making them a prime attack surface for memory corruption bugs.

An out-of-bounds write occurs when an application writes data outside the intended boundary of a allocated memory buffer. In the context of CVE-2026-87491, a malicious website can trigger this logic flaw through carefully engineered JavaScript or WebAssembly constructs embedded in an HTML page. Once triggered, the flaw allows an attacker to corrupt adjacent memory structures in the browser’s renderer process.

Security researcher Jihyeon Jeong of Compsec Lab at Seoul National University discovered and responsibly reported the flaw on August 6, 2026, receiving a $2,500 bug bounty reward. While execution is currently contained inside Chrome’s renderer sandbox, successful sandbox exploitation allows an attacker to manipulate web page content, access sensitive memory within the rendered context, or pair the exploit with a secondary sandbox-escape bug to compromise the underlying host operating system.

Exploitation Dynamics and Risk Assessment

Google confirmed that an exploit for CVE-2026-87491 exists and is being actively weaponized, though specific details regarding threat actor attribution, target profiles, and technical attack chains remain restricted. Google routinely delays publishing granular exploit specifics until a majority of the active user base has updated, preventing adversary groups from reverse-engineering the patch to develop derivative exploits.

Evaluating the severity vector provides critical context for enterprise threat teams. The vulnerability carries a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Translating this rating into practical terms:

• Network Reachable (AV:N): Attacks can be delivered remotely over standard HTTP/HTTPS channels without requiring specialized local access.
• Low Attack Complexity (AC:L): Exploitation does not require special timing conditions or race conditions once a victim navigates to the malicious page.
• Unprivileged Access (PR:N): The attacker requires no prior authentication or system privileges on the target environment.
• User Interaction Required (UI:R): A user must perform a basic action, such as clicking a malicious link or visiting a compromised site hosting the payload.
• High Impact (C:H/I:H/A:H): Successful execution grants full control over the compromised process, severely impacting confidentiality, integrity, and availability within the renderer environment.

Interestingly, predictive threat models such as the Exploit Prediction Scoring System (EPSS) assigned CVE-2026-87491 an EPSS score of 0.29% (putting it in the 21.4th percentile of all scored CVEs). This scenario highlights a crucial operational reality for vulnerability management programs: statistical threat scoring models calculate probability based on historical patterns, but confirmed in-the-wild exploitation overrides low statistical probability scores. When active zero-day exploitation is confirmed by the vendor, immediate remediation takes precedence over static or predictive priority metrics.

CVE-2026-87491 joins six other Chrome zero-days patched earlier this year: CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, and CVE-2026-85046.

Broader Chrome Release and Downstream Impact

Beyond the zero-day, the current Chrome security update addresses 229 additional security bugs. Google noted that 195 of these fixes originated from internal security audits and automated fuzzing frameworks, including AddressSanitizer, MemorySanitizer, libFuzzer, and Control Flow Integrity.

Among the external reports resolved in this cycle are five critical-severity vulnerabilities affecting Chrome’s WebGL and Cast components, alongside a high-severity use-after-free bug in WebPackaging (CVE-2026-87639) credited to OpenAI Codex Security.

Because the V8 engine is a core foundational component of the open-source Chromium project, this zero-day directly impacts the broader Chromium ecosystem. Third-party browser vendors utilizing Chromium—including Microsoft Edge, Brave, Opera, and Vivaldi—are inherently exposed to CVE-2026-87491 until they merge Google’s upstream security fixes into their respective build channels.

Immediate Remediation Steps

Organizations and individual end users should verify that their installations of Google Chrome are updated to the following secure baseline versions:

• Windows and macOS: Version 153.0.8010.36/.37 or later
• Linux: Version 153.0.8010.36 or later

To apply the patch manually on desktop clients:

1. Open Google Chrome and navigate to the top-right menu (three vertical dots).
2. Select Help > About Google Chrome.
3. Allow Chrome to fetch and download the update automatically.
4. Click Relaunch to restart the browser process and complete patch installation.

Enterprise system administrators should enforce automated browser updates through Group Policy, Mobile Device Management (MDM), or Google Admin Console, forcing browser relaunches to terminate stale, vulnerable renderer processes currently residing in active system memory. Security teams tracking downstream Chromium applications (such as Microsoft Edge) should monitor vendor advisory channels and apply platform updates immediately upon availability.