CVE-2026-87491: Chrome V8 Zero-Day Exploited in the Wild Enables Arbitrary Code Execution

Google has released Chrome 153 with a fix for another zero-day vulnerability already being exploited in real-world attacks. Tracked as CVE-2026-87491, the flaw is an out-of-bounds write vulnerability in V8, the JavaScript and WebAssembly engine at the core of Google Chrome. Successful exploitation can allow a remote attacker to execute arbitrary code inside the browser sandbox through a specially crafted HTML page.

The vulnerability was fixed in Chrome 153.0.8010.36/.37 for Windows and macOS and 153.0.8010.36 for Linux as part of the September 8, 2026 Stable Channel release. Google confirmed that an exploit already exists in the wild but has not disclosed who is using it, which organizations have been targeted, or how the exploit is being delivered.

Despite Google assigning the vulnerability a Medium Chromium security severity, its exploitation status significantly raises the operational risk. Memory corruption in V8 can provide attackers with code execution in a renderer process and may become part of a larger browser exploit chain when paired with another flaw capable of escaping Chrome’s sandbox.

The new Chrome zero-day bug exploited in attacks is the seventh Chrome vulnerability patched by Google this year after being used as a zero-day, highlighting how browser engines remain a high-value target for sophisticated threat actors.

Contact Sales

CVE-2026-87491 analysis

CVE-2026-87491 is categorized as CWE-787: Out-of-Bounds Write. This type of memory-safety weakness occurs when software writes data outside the boundaries of the memory buffer allocated for a particular object or operation. In a highly complex JavaScript engine such as V8, such corruption can affect adjacent memory structures and potentially alter program execution.

The most important details for CVE-2026-87491 are contained in Google’s CVE description: Chrome versions before 153.0.8010.36 can allow a remote attacker to execute arbitrary code inside the browser sandbox by delivering a crafted HTML page.

This gives attackers a relatively familiar browser-based delivery scenario. A victim could be directed to malicious web content through a phishing link, compromised website, malicious advertisement, redirect chain, or another web-based lure. When Chrome processes specially crafted JavaScript or HTML, the vulnerable V8 code path can trigger an out-of-bounds write and corrupt memory.

CVE-2026-87491 affects Google Chrome releases earlier than 153.0.8010.36. The CVE record identifies 153.0.8010.36 as the first non-affected version boundary.

Successful exploitation can provide arbitrary code execution within Chrome’s sandbox. That distinction matters because sandboxing creates an additional boundary between malicious browser content and the underlying operating system.

An attacker exploiting CVE-2026-87491 alone should therefore not automatically be described as gaining complete control of Windows, macOS, or Linux. A more complete endpoint compromise could require another vulnerability that allows the attacker to escape the renderer sandbox or elevate privileges after initial browser code execution.

Nevertheless, browser-sandbox code execution is a powerful first stage. It can allow an adversary to manipulate the compromised renderer process and potentially prepare a second-stage exploit against another browser or operating-system weakness.

BleepingComputer also notes that corruption resulting from the out-of-bounds write may allow access beyond the intended memory buffer, potentially exposing sensitive process information or causing Chrome to crash.

The flaw was reported to Google by Jihyeon Jeong of Compsec Lab at Seoul National University, who was also working as a research intern. Google’s release notes list the report date as August 6, 2026 and award a $2,500 bug bounty for the finding.

Google publicly shipped the security fix with Chrome 153 on September 8, 2026. The release contains 230 security fixes in total, making it a substantially larger security update than the emergency releases typically issued for individual zero-days.

In addition to CVE-2026-87491, Chrome 153 addresses five Critical-rated vulnerabilities, including use-after-free and out-of-bounds write issues affecting WebGL and Cast. Dozens of High-severity issues were also fixed across components including V8, ANGLE, PDFium, DevTools, Web Authentication, Payments, and other browser subsystems.

Google has intentionally restricted access to the Chromium issue associated with the zero-day. The company routinely limits vulnerability details until most Chrome users have received security updates, reducing the likelihood that additional threat actors can quickly reproduce an exploit from detailed technical information.

At the time of publication, no reliable public CVE-2026-87491 PoC had been identified in the reviewed sources. Google’s statement that an exploit exists in the wild confirms that functional exploitation capability exists privately, but that does not mean the actual attack code has been publicly released.

Google has likewise not published campaign-level CVE-2026-87491 IOCs such as malicious domains, IP addresses, exploit files, payload hashes, or details about targeted organizations. This limits defenders’ ability to rely on conventional static indicators when looking retrospectively for exploitation.

The absence of those indicators makes endpoint and browser telemetry particularly important. Organizations should combine version assessment with investigation of suspicious browser behavior, renderer crashes, unusual process relationships, and follow-on activity occurring after visits to potentially malicious sites.

The vulnerability follows closely behind CVE-2026-85046, another actively exploited V8 zero-day that Google patched on September 3. CVE-2026-85046 is a type confusion flaw, whereas CVE-2026-87491 is an out-of-bounds write. Both demonstrate the continuing attacker interest in V8 as an entry point for browser exploitation.

CVE-2026-87491 Mitigation

The primary remediation is to upgrade Chrome immediately to the latest Stable Channel release. Google has released:

• Windows: Chrome 153.0.8010.36/.37 or later
• macOS: Chrome 153.0.8010.36/.37 or later
• Linux: Chrome 153.0.8010.36 or later

Chrome normally downloads updates automatically, but users must relaunch the browser for the new executable to replace the vulnerable running version. Because Google says the staged rollout can take days or weeks, organizations should not assume every endpoint has already received the patch.

Users can manually verify their installed version by opening:

Chrome → Help → About Google Chrome

Enterprise security and IT teams should use browser-management or endpoint-management tooling to verify versions across the entire fleet rather than relying solely on individual users to restart their browsers.

CVE-2026-87491 detection should start with an inventory of Chrome installations. Any endpoint running a desktop version earlier than 153.0.8010.36 should be considered exposed and prioritized for immediate updating.

To Detect CVE-2026-87491 exploitation attempts or suspicious post-exploitation activity, defenders should investigate combinations of:

• Unexpected Chrome renderer crashes
• Browser memory-corruption alerts generated by EDR or exploit-protection tooling
• Unusual Chrome child-process behavior
• Unexpected processes launched shortly after suspicious browser activity
• Visits to newly registered, compromised, or known malicious domains shortly before a browser crash
• Executable or script activity immediately following a Chrome session
• Suspicious files downloaded or created by browser-related processes
• Attempts to exploit an additional sandbox escape or privilege-escalation vulnerability
• Unexpected outbound connections from processes spawned after Chrome activity
• New persistence mechanisms appearing shortly after suspicious web browsing

These behaviors should be treated as investigation leads rather than vulnerability-specific signatures because Google has not disclosed the exploit used in observed attacks.

Security teams should correlate endpoint telemetry with DNS, secure web gateway, proxy, email, and network records. If a system running an affected Chrome version visited suspicious infrastructure immediately before memory corruption, abnormal browser behavior, or post-exploitation activity, that endpoint warrants deeper forensic examination.

Organizations should also confirm that Chrome was restarted after the update. An installer may download a secure version while an older vulnerable Chrome process remains active until the browser is relaunched.

For managed environments, administrators should consider enforcing rapid browser restart policies for high-priority security releases and monitoring compliance with the fixed version across endpoints.

The CVE-2026-87491 mitigation process should also include retrospective investigation for high-risk endpoints that were exposed before the September 8 update. Since Google has already confirmed exploitation in the wild, installing the patch prevents future exploitation but cannot establish whether an endpoint was compromised earlier.

Users of other Chromium-based browsers should monitor security releases from their respective vendors and install versions incorporating the relevant Chromium/V8 fixes when available.