Google has released an emergency Chrome security update addressing an actively exploited zero-day vulnerability in the browser’s V8 JavaScript and WebAssembly engine. The flaw, tracked as CVE-2026-87491, is an out-of-bounds write that can allow attackers to execute arbitrary code inside Chrome’s sandbox through a specially crafted web page.
The vulnerability affects Chrome versions prior to 153.0.8010.36. According to the vulnerability description, a remote attacker could trigger the flaw by convincing a victim to visit malicious HTML content, potentially gaining code execution within the browser’s sandbox.
Google confirmed that an exploit for CVE-2026-87491 exists in the wild, making the update particularly urgent. However, the company has not disclosed who is exploiting the vulnerability, how widespread the attacks are, or which organizations and users are being targeted.
The vulnerability was discovered by Jihyeon Jeong of Compsec Lab at Seoul National University and reported to Google on August 6, 2026. The researcher received a $2,500 bug bounty for the discovery.
Google is currently restricting access to detailed technical information about the vulnerability. This is standard practice for actively exploited Chrome flaws, as delaying publication of exploit details gives users and organizations additional time to install security updates before more attackers can reproduce the technique.
CVE-2026-87491 is the seventh actively exploited Chrome zero-day patched by Google since the beginning of 2026. The growing number of in-the-wild vulnerabilities demonstrates why browsers remain attractive targets, particularly because they routinely process untrusted content from websites, advertisements and third-party scripts.
The latest Chrome release addresses 230 security vulnerabilities in total. Five additional vulnerabilities are rated critical, including multiple use-after-free and memory-corruption flaws affecting WebGL, as well as a use-after-free vulnerability in the Cast component.
One high-severity vulnerability in WebPackaging, tracked as CVE-2026-87639, was discovered by OpenAI Codex Security. Google said that 195 of the 230 vulnerabilities fixed in the release were identified through its own security efforts and automated security technologies.
The fact that CVE-2026-87491 provides code execution inside the sandbox is an important limitation when assessing its impact. Chrome’s sandbox is specifically designed to restrict what compromised browser processes can access, meaning attackers would generally need an additional vulnerability or technique to fully escape those restrictions and gain broader control of the operating system.
Nevertheless, browser vulnerabilities are frequently combined into exploit chains. An attacker could use a V8 vulnerability for initial code execution and then combine it with a sandbox escape or privilege-escalation flaw to compromise the underlying device.
Google recommends updating Chrome to versions 153.0.8010.36 or 153.0.8010.37 on Windows and macOS, and version 153.0.8010.36 on Linux. Users can verify their version through Chrome’s About page, which automatically checks for available updates and requires a browser restart to complete installation.
Users of Chromium-based browsers such as Microsoft Edge, Brave, Opera and Vivaldi should also install security updates as vendors make them available. Because these browsers share Chromium components, vulnerabilities affecting V8 can potentially affect the wider Chromium ecosystem.
With confirmed exploitation already taking place, organizations should prioritize deployment rather than waiting for their normal browser maintenance cycle. The lack of public information about the attacks makes it difficult to determine who is currently at greatest risk, making rapid patching the most effective protection against CVE-2026-87491.