Actively Exploited V8 Bug Headlines Massive 230-Flaw Chrome Security Update
Google confirms attackers are already abusing CVE-2026-87491, a memory-corruption bug in Chrome's JavaScript engine that can be triggered by simply loading a booby-trapped web page.
Google has pushed a stable-channel Chrome release that closes 230 security holes, and at least one of them is already being used against real users.
The flaw under attack is tracked as CVE-2026-87491 and sits in V8, the engine Chrome uses to run JavaScript and WebAssembly. It is an out-of-bounds write — a class of memory-corruption bug where code writes past the end of an allocated buffer — and according to the entry filed with the NIST National Vulnerability Database, a remote attacker who can get a victim to open a specially built HTML page can use it to run arbitrary code inside Chrome's sandbox. Every build before 153.0.8010.36 is affected.
Notably, Google has rated the issue only medium severity, which reflects the fact that execution is confined to the sandbox rather than escaping to the underlying operating system. In practice, attackers rarely stop there: a V8 write primitive is the kind of thing that gets chained with a second sandbox-escape bug to reach the host, so the medium label is a poor guide to how urgently the patch should be applied.
Who found it, and who is using it
The bug was reported on August 6, 2026 by Jihyeon Jeong of Compsec Lab at Seoul National University, who earned a $2,500 bounty for the disclosure.
Google says it is aware that an exploit exists in the wild, but has released nothing about the campaigns using it, the targets, or the group behind them. That silence is standard: the company routinely holds back technical detail and bug-tracker access until most of the install base has updated, and keeps the restriction in place longer if the same code exists in a shared third-party library that other projects have yet to fix.
CVE-2026-87491 is the seventh Chrome zero-day Google has patched under active exploitation in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645 and CVE-2026-85046.
Five critical bugs also fixed
Alongside the zero-day, the release resolves five flaws rated critical, four of them in WebGL:
- CVE-2026-87464 — use-after-free in WebGL
- CVE-2026-87488 — use-after-free in WebGL
- CVE-2026-87438 — out-of-bounds write in WebGL
- CVE-2026-87527 — buffer overflow in WebGL
- CVE-2026-87628 — use-after-free in Cast
Most of the update is the result of Google's own internal work: the company says it found and reported 195 of the 230 issues itself, largely through automated tooling including AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer and AFL. One high-severity use-after-free in WebPackaging, CVE-2026-87639, is credited to OpenAI Codex Security — a sign of how quickly AI-assisted bug hunting is showing up in vendor acknowledgements.
What to do now
Users on Windows and macOS should be running 153.0.8010.36 or .37; Linux users need 153.0.8010.36. Chrome downloads updates automatically, but the new build does not take effect until the browser restarts, so it is worth forcing the check via More > Help > About Google Chrome and then clicking Relaunch.
Anyone on a Chromium-based alternative — Microsoft Edge, Brave, Opera or Vivaldi — inherits the same V8 code and should install their vendor's patch as soon as it ships.
Related reporting
Hackers Exploit Critical WSO2 API Manager JWT Flaw Using Forged Admin Tokens
Security researchers have detected active exploitation attempts targeting a critical authentication-bypass vulnerability in WSO2 API Manager, with attackers sending forged JSON Web Tokens (JWTs) containing administrator privileges.
Nintendo Switch Vulnerability Lets Nearby Attackers Run Unauthorized Code via QR Code Feature
Nintendo has patched a high-severity vulnerability in the original Nintendo Switch that could allow a nearby attacker to execute unauthorized code or access information stored on the console.
China-Linked Hackers Chain Chrome and Windows Zero-Days to Deploy GRIMWEDGE Backdoor
China-linked threat actors have been observed chaining multiple vulnerabilities in Google Chrome and Microsoft Windows as part of sophisticated cyber-espionage campaigns targeting non-governmental organizations and other high-value organizations.