Full Breakdown
Google Patches Actively Exploited Chrome V8 Zero-Day (CVE-2026-87491)
9/9/2026, 6:47:18 PM
Core Event
On September 9, 2026 Google released Chrome 153.0.8010.36 (and .37 for Windows and macOS) that patches a medium-severity out-of-bounds write flaw in the V8 JavaScript and WebAssembly engine, identified as CVE-2026-87491. The vulnerability allows a remote attacker to execute arbitrary code inside Chrome’s sandbox by delivering a specially crafted HTML page. Google confirmed that an exploit for this flaw is already being used in the wild, though it did not disclose technical details or the actors behind the attacks.
Background & Context
CVE-2026-87491 is the seventh Chrome zero-day actively exploited in 2026. Earlier exploited flaws this year include:
- CVE-2026-2441 (February) – use-after-free in CSS.
- CVE-2026-3909 and CVE-2026-3910 (March) – out-of-bounds write in the Skia graphics library and a V8 engine flaw, respectively.
- CVE-2026-5281 (April) – use-after-free in the Dawn WebGPU component.
- CVE-2026-11645 (June) – out-of-bounds memory access in V8.
- CVE-2026-85046 (early September) – V8 type-confusion vulnerability also exploited in the wild.
These incidents illustrate a pattern of high-severity memory-corruption bugs in Chrome’s rendering and graphics subsystems throughout the year.
Data & Statistics
- Total flaws addressed in the September release: 230.
- Actively exploited zero-days patched in 2026: seven (including CVE-2026-87491).
- Critical issues in the same update: five WebGL vulnerabilities (CVE-2026-87464, CVE-2026-87488, CVE-2026-87438, CVE-2026-87527) and one critical use-after-free in the Cast component (CVE-2026-87628).
- The researcher who reported CVE-2026-87491, Jihyeon Jeong of the Compsec Lab at Seoul National University, received a $2,500 bug-bounty reward.
Official Statements & Responses
Google’s security advisory stated that the company is aware of an active exploit for CVE-2026-87491 and that details of the bug will remain restricted until a majority of users have updated. The company also noted that it may retain restrictions if the flaw exists in third-party libraries that other projects depend on. In guidance to users, Google advised updating to Chrome 153.0.8010.36 (or .37 where applicable) via the browser’s “About Google Chrome” menu and restarting the browser promptly. The advisory emphasized that the update is being rolled out gradually over the coming days and weeks.
Conflicting Reports & Gaps
While Google confirmed the existence of an in-the-wild exploit, it did not disclose how the vulnerability is being weaponized, which threat actors are involved, or whether the exploit is chained with additional flaws to escape the sandbox. No external source provided concrete attribution or technical specifics, leaving a gap in public understanding of the attack’s scope and targets.
What’s Next
Google will continue distributing the Chrome 153 update across all platforms, with Linux users receiving version 153.0.8010.36 and Windows/macOS users receiving versions 153.0.8010.36 and 153.0.8010.37. Users of other Chromium-based browsers—such as Microsoft Edge, Brave, Opera, and Vivaldi—are advised to apply the corresponding fixes when they become available. Security researchers and organizations are encouraged to monitor Google’s advisories for any further disclosures related to this or future Chrome vulnerabilities.
