Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox
Google released a security update to patch 230 vulnerabilities, including a zero-day actively exploited in the wild (CVE-2026-87491) within Chrome's V8 JavaScript engine. This allows remote attackers to execute arbitrary code inside a sandbox via a crafted HTML page. Google has addressed 195 of the 230 reported flaws and urges users to update to version 153.0.8010.36 or later to mitigate the risk.
Google has released a security update addressing 230 vulnerabilities within Chrome. A critical zero-day, CVE-2026-87491, has been actively exploited in the wild, stemming from an out-of-bounds write in V8, Chrome's JavaScript and WebAssembly engine. Security researcher Jihyeon Jeong of Compsec Lab, Seoul National University, discovered and responsibly disclosed the flaw, receiving a $2,500 bug bounty. Google acknowledged the exploit's existence and has restricted access to bug details until a majority of users are updated. The update addresses a total of 195 of the 230 reported flaws. Alongside CVE-2026-87491, the update also fixes five critical security flaws in WebGL and Cast components: CVE-2026-87464 (Use-after-free in WebGL), CVE-2026-87488 (Use-after-free in WebGL), CVE-2026-87438 (Out-of-bounds write in WebGL), CVE-2026-87527 (Buffer overflow in WebGL), and CVE-2026-87628 (Use-after-free in Cast). Google utilizes tools like AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL to detect these vulnerabilities. Users are advised to update to Chrome version 153.0.8010.36/.37 for Windows and Apple macOS, and 153.0.8010.36 for Linux. Chromium-based browsers like Microsoft Edge, Brave, Opera, and Vivaldi should also be updated as patches become available.