Google has patched a Chrome vulnerability already being exploited in real attacks. It released the fix on Thursday within a major security update. That update addressed a substantial 230 security vulnerabilities in total. However, one flaw stood out due to active exploitation in the wild.
The exploited bug is now tracked as CVE-2026-87491. It is an out-of-bounds write flaw in Chrome’s V8 engine. V8 powers Chrome’s JavaScript and WebAssembly processing directly. The flaw lets attackers execute arbitrary code inside the browser sandbox.
Critically, attackers trigger it through a specially crafted HTML page. Therefore, simply visiting a malicious website could launch the attack. Out-of-bounds write flaws let attackers corrupt memory precisely. Consequently, they can chain toward full code execution reliably.
Security researchers note why these bugs prove so dangerous. Such memory flaws often help bypass key browser protections. For instance, they can defeat address space layout randomization. Attackers then pair them with a second sandbox-escape flaw. This combination enables a complete, reliable exploit chain. Ultimately, browser zero-days serve as a front door for spyware.
A security researcher discovered and reported the flaw responsibly. Jihyeon Jeong of Seoul National University found it in August. The researcher received a $2,500 bug bounty for the disclosure. Google confirmed an exploit for the flaw exists actively.
However, Google withheld further technical details for now. It has not disclosed how attackers weaponize the flaw. Additionally, it has not attributed the attacks to anyone. Google typically restricts such details until most users update. Its internal bug tracker entry also remains locked meanwhile.
This marks the seventh actively exploited Chrome zero-day this year. Notably, it follows another V8 zero-day patched just days earlier. That earlier flaw, CVE-2026-85046, was a type confusion bug. Three of this year’s zero-days targeted V8 specifically.
The wider 2026 pattern reveals a consistent story. Every exploited flaw this year involved memory-safety issues. February brought a CSS engine flaw exploited in attacks. March delivered flaws in both Skia and V8. April and June added WebGPU and V8 bugs respectively.
Security experts highlight why V8 remains such a frequent target. It is the most reachable, heavily optimized attack surface available. Furthermore, it processes untrusted code on every single page load. It also remains written in the memory-unsafe C++ language.
The update also fixed five critical flaws beyond the zero-day. These affected the WebGL and Cast components specifically. Interestingly, AI now assists in finding some bugs. One flaw was credited directly to OpenAI Codex Security.
Google reported 195 of the 230 fixes itself. It found many using automated memory-error detection tools. These include AddressSanitizer and various fuzzing frameworks. This reflects Google’s growing reliance on automated discovery.
Regulators have responded swiftly to similar recent flaws. For the earlier zero-day, US authorities acted within a day. Specifically, CISA added it to its Known Exploited Vulnerabilities catalog. That listing forces federal agencies to patch by strict deadlines. Consequently, organizations worldwide often treat such listings as urgent.
Users should update Chrome immediately to stay protected. The fix arrives in versions 153.0.8010.36 and .37. Users update via Help, then About Google Chrome. The browser then downloads the patch and prompts a relaunch. Notably, closing and reopening Chrome alone may not suffice.
The threat also extends beyond Chrome to related browsers. Every Chromium-based browser inherits this same underlying flaw. Therefore, Edge, Brave, Opera, and Vivaldi need updating too. Countless Electron-based desktop apps embed the same engine.
