Google Patches Seventh Actively Exploited Chrome Zero-Day of 2026 (CVE-2026-87491)

Overview

Google has issued an emergency update for desktop browser users following confirmation of active, in-the-wild exploitation targeting a memory corruption flaw in its core engine. Tracked as CVE-2026-87491, the high-impact Google Chrome vulnerability allows remote attackers to execute arbitrary code within the browser sandbox process simply by tricking a victim into visiting a malicious HTML page.

The security update is bundled into Chrome version 153.0.8010.36 (and .37 for Windows and macOS, as well as 153.0.8010.36 for Linux), addressing 230 total vulnerabilities in the browser platform. The zero-day flaw was originally reported on August 6, 2026, by researcher Jihyeon Jeong of the Compsec Lab at Seoul National University, who received a $2,500 bug bounty reward for the discovery. In line with Google’s standard security posture, granular technical details regarding the specific exploit chain are currently restricted until a critical mass of the global install base updates their browser software.

Technical Deep Dive: V8 Out-of-Bounds Memory Corruption

The root cause of CVE-2026-87491 resides within V8, Chrome’s open-source JavaScript and WebAssembly execution engine. V8 processes untrusted script code provided by web applications, using Just-In-Time (JIT) compilation to transform scripts into optimized machine code for high performance.

The bug is classified as an out-of-bounds (OOB) write (CWE-787). In memory safety terms, an out-of-bounds write occurs when software writes data past the end, or before the beginning, of an allocated memory buffer. Within a JIT-compiled environment like V8, these flaws frequently stem from improper bounds-check elimination or incorrect type assumptions during optimization passes. When an attacker supplies a specially crafted JavaScript array or WebAssembly object, V8 miscalculates the required buffer allocation or boundary checks.

The exploit vector is straightforward and carries minimal attack friction:

• Attack Vector (AV:N): The flaw is exploitable remotely over the network without local or physical access requirements.
• Attack Complexity (AC:L): Low complexity; once a stable exploit payload is constructed, execution does not rely on rare race conditions or specific target configurations.
• Privileges Required (PR:N): No administrative or user authentication is required prior to execution.
• User Interaction (UI:R): Requires user interaction, specifically persuading a victim to open or be redirected to a web page hosting the malicious exploit script.

When successfully triggered, the out-of-bounds write allows the attacker to overwrite adjacent heap memory objects. This memory corruption enables the adversary to manipulate pointers, hijack control flow, and achieve arbitrary code execution inside the renderer process. While Google categorizes the bug’s severity as Medium due to Chrome’s multi-process architecture isolating the renderer within a restricted OS sandbox, the initial code execution component carries a standard CVSS v3.1 score of 8.8 (High), reflecting full Confidentiality, Integrity, and Availability impacts at the process level.

The Context: 2026 Chrome Zero-Day Landscape & Threat Nuance

CVE-2026-87491 marks the seventh zero-day vulnerability patched in Google Chrome since the start of 2026. It joins a growing list of browser zero-days exploited in targeted adversary campaigns earlier this year:

• CVE-2026-2441 (Patched in February)
• CVE-2026-3909 and CVE-2026-3910 (Patched in March)
• CVE-2026-5281 (Patched in April)
• CVE-2026-11645 (Patched in June)
• CVE-2026-85046 (Patched in early September)

The frequency of V8 and rendering engine zero-days underscores the central role web browsers play as initial access vectors for sophisticated threat actors. Modern drive-by-download campaigns and targeted spear-phishing operations rely on browser engine RCE vulnerabilities as the entry point. Once inside the sandboxed renderer, attackers routinely chain these flaws with OS-level kernel exploits or sandbox escapes to achieve persistent system compromise, extract stored browser credentials, and pivot into corporate network environments.

This event also highlights a crucial nuance regarding automated risk scoring models. Current metrics from the Exploit Prediction Scoring System (EPSS) assign CVE-2026-87491 an exploitation probability of just 0.29% over a 30-day window (placing it in the 21.4th percentile of scored vulnerabilities). EPSS relies heavily on public scanning telemetry, published proof-of-concept repositories, and widespread exploit activity. For active zero-days used in targeted, undisclosed attacks before vendor notification, predictive scoring models often display a significant lag. Security teams that rely solely on automated EPSS thresholds to prioritize patching risk overlooking zero-day threats that are actively weaponized in real-world environments.

Recommended Action & Remediation

Organizations and individual users should immediately verify that their desktop browser installations are running updated builds. System administrators managing enterprise endpoints should force an immediate browser restart across their fleet to apply the update.

Target Patch Versions:

• Windows & macOS: Upgrade to Google Chrome 153.0.8010.36, 153.0.8010.37, or higher.
• Linux: Upgrade to Google Chrome 153.0.8010.36 or higher.

To manually trigger the update check on desktop clients, navigate to chrome://settings/help in the address bar. Chrome will automatically fetch the latest release binaries and prompt the user to relaunch the browser to finalize installation. Third-party Chromium-based browsers—such as Microsoft Edge, Brave, Opera, and Vivaldi—depend on the V8 engine and are expected to publish downstream security updates incorporating this fix in the coming days. Network operators should monitor downstream vendor advisories and enforce corresponding patches as soon as they become available.