HIGH: Chrome V8 Zero-Day CVE-2026-87491 Exploited in the Wild

Google pushed Chrome 153 to the stable channel today with fixes for 230 security issues, which is a large number even by Chrome's standards. Exactly one of those 230 is being exploited against real people right now, and that is the one worth interrupting your morning for. CVE-2026-87491 is an out-of-bounds write in V8, the JavaScript and WebAssembly engine that sits at the heart of every Chromium browser on the planet, and Google's release notes carry the sentence that always changes the math. Google is aware that an exploit for CVE-2026-87491 exists in the wild.

That brings the count to seven actively exploited Chrome zero-days in 2026. More to the point, it brings the count to two in five days, because CVE-2026-85046, a type confusion bug in the very same engine, got an emergency fix on September 3. Somebody is spending real money and real research hours on V8 right now, and they are getting a return on that investment.

What actually broke

V8 is the component that takes the JavaScript on a web page and turns it into machine code your CPU will actually run. It is fast because it is aggressive, and it is aggressive because nobody wants to wait four seconds for a page to become interactive. That tradeoff has been the single most productive vulnerability class in browser security for well over a decade, and CVE-2026-87491 is another entry in the ledger.

An out-of-bounds write means the engine can be tricked into writing data past the end of a memory buffer it legitimately owns. Once an attacker can write outside the lines, they can start corrupting adjacent structures on the heap, and from there the goal is a reliable read and write primitive across the process address space. In practice that gets you arbitrary code execution inside the Chrome renderer process. All of it happens from a crafted HTML page, so the entire attack requires nothing more than convincing a browser to load a URL.

Jihyeon Jeong of the Compsec Lab at Seoul National University reported the flaw to Google on August 6, 2026, and collected a $2,500 bounty for it. Whether the researcher found the same bug an attacker was already using, or the attacker found it independently after the report and before the patch, Google is not saying. What we do know is that roughly a month elapsed between the report and the fix, and that at some point during that window the flaw went from academic finding to live weapon.

About that severity rating

Here is the part that trips people up. Google rated CVE-2026-87491 as medium severity. NVD has not assigned a CVSS score at the time of writing. A medium rating on a bug that is being exploited in the wild looks like a contradiction, and every time this happens somebody on a security team argues that the vendor is downplaying it.

They are not, at least not exactly. Chrome's severity ratings describe the damage a bug does on its own, and on its own this one lands the attacker inside the renderer sandbox. The sandbox exists precisely so that renderer compromise is not game over. To get from a compromised renderer to your files, your tokens, and your persistence, an attacker needs a second bug that escapes the sandbox, and sandbox escapes are expensive.

The problem with that reassurance is that anybody sophisticated enough to be running a V8 zero-day in the wild is almost certainly not stopping at the renderer. Exploit chains are how this works. The commercial spyware market and the nation-state teams that buy from it do not deploy half a chain and hope for the best. Google explicitly declined to say whether this bug is being chained with a sandbox escape, and it also declined to describe the targeting or the weaponization, which is the standard playbook of withholding detail until patch adoption catches up. Treat the medium rating as a description of one link, not of the chain you are actually facing.

There is also a practical reason not to relax. Renderer code execution alone is enough to read the contents of any page rendered in that process, which on a modern site with strict site isolation still means everything on the origin the victim was visiting. Session tokens, form contents, and whatever your webmail happened to be displaying are all in scope without any escape at all.

Who is affected and what exploitation looks like

Everyone running Chrome before 153.0.8010.36 is exposed, on Windows, macOS, and Linux alike. Google is shipping 153.0.8010.36 and 153.0.8010.37 to Windows and macOS, with 153.0.8010.36 going out to Linux. The rollout is staged, which is the detail most organizations forget, and it is why manual verification beats waiting for the update to arrive on its own.

The bigger exposure is everything downstream of Chromium. Microsoft Edge, Brave, Opera, Vivaldi, Arc, and the endless list of Electron applications sitting on your users' desktops all embed V8. Those projects pick up Chromium security fixes on their own schedules, and that schedule is rarely the same day. Every Slack client, every Teams desktop app, and every internal tool somebody shipped as an Electron bundle three years ago and never updated is running a JavaScript engine with this bug in it until its maintainer ships a rebuild. In most environments the browser gets patched within days and the Electron apps get patched in months, if ever.

Exploitation looks like nothing. That is the honest answer. The victim visits a page, the page runs JavaScript, and the JavaScript corrupts memory in a process that was always going to be running untrusted code anyway. There is no download prompt, no macro warning, no certificate error. Delivery is typically either a watering hole on a site the intended targets already visit, or a targeted link delivered over email or a messaging platform. Malvertising is the third option and the one that turns a targeted capability into a broad one, because an ad network will happily serve attacker JavaScript on a site with an impeccable reputation.

What to do about it

Update Chrome. Open the menu, go to Help and then About Google Chrome, confirm you are on 153.0.8010.36 or later, and then actually relaunch the browser, because the update does not apply until the process restarts. Users who leave forty tabs open and never close Chrome are the reason browser patches lag in real environments, and a forced relaunch policy is worth the complaints it generates.

If you manage a fleet, push this through whatever you use rather than trusting the staged rollout. On Windows, the Chrome ADMX policies let you set an update deadline and a relaunch notification period, and this is the week to shorten both. On macOS, Google's own update mechanism plus an MDM enforcement check will catch the stragglers. Query your endpoints for installed Chrome versions and treat anything below 153.0.8010.36 as an open finding rather than assuming the auto-updater did its job. Then run the same query for Edge and any other Chromium browser your users have installed, and start a list of Electron applications you will need to chase.

For detection, do not expect a signature. What you can look for is the second-order behavior. Renderer processes spawning child processes are worth an alert, since Chrome's own architecture rarely does that outside of known patterns. Unexpected outbound connections from browser processes to freshly registered domains, browser child processes touching credential stores or the local state file where Chrome keeps its encryption key, and crash telemetry spikes in V8 are all reasonable hunting hypotheses. Repeated renderer crashes on a specific origin are a genuinely useful signal, because exploit development against V8 is unreliable and failed attempts crash tabs before successful ones land.

Site isolation and the enhanced security modes are already on by default in most builds, and they are worth confirming rather than assuming. If you have populations of high risk users, executives, finance staff, anybody handling sensitive negotiations, Chrome's Advanced Protection Program and shorter update deadlines for those groups are cheap controls that meaningfully raise the cost of this exact attack pattern.

The broader lesson for the year is that browser patching has quietly become an operational tempo problem rather than a monthly maintenance task. Seven exploited zero-days in nine months, two of them in the same engine within a single week, is not a series of unlucky events. It is a stable market with buyers, and the only defense that scales is closing the window between Google shipping a fix and your endpoints running it.

MSP Angle

Browser patch latency is one of the easiest gaps to prove to a prospect and one of the easiest to close profitably. Run a Chrome and Edge version report across a prospect's fleet, show them how many endpoints are still sitting on a build with an actively exploited zero-day, and you have justified a managed patching engagement in a single screenshot. The follow-on sale is the harder problem, which is the Electron and embedded Chromium inventory nobody owns, and a recurring third party application patching service priced per endpoint is a natural upsell that competitors relying on Windows Update alone simply cannot deliver.