Google Patches Seventh Chrome Zero-Day of 2026 After Active Exploitation
A high-severity out-of-bounds write vulnerability in the V8 engine has forced an emergency update for Windows, Mac, and Linux users.
Google has released an emergency security update to address a high-severity zero-day vulnerability in the Chrome browser that was being actively exploited by attackers. The flaw, tracked as CVE-2026-87491, affects the V8 JavaScript and WebAssembly engine, a core component of the browser's processing power.
The vulnerability is characterized as an out-of-bounds write weakness. According to Google, the company is aware that an exploit for CVE-2026-87491 exists in the wild, necessitating a rapid rollout of patches across the Stable Desktop channel. The bug was first reported to Google by Jihyeon Jeong, a research intern at Seoul National University's Compsec Lab.
Users are urged to update to the following patched versions immediately: 153.0.8010.36 for Windows and Linux, and 153.0.8010.37 for Mac.
A Pattern of Vulnerability
This latest patch marks the seventh actively exploited Chrome zero-day Google has had to address since the beginning of 2026. The year has seen a relentless stream of critical flaws, including an iterator invalidation bug in February, two separate bugs in March affecting Skia and V8, a WebGPU flaw in April, and a V8 type confusion flaw earlier this month. This follows a similarly volatile 2025, during which Google fixed eight other exploited zero-days.
Why the V8 Engine is a Target
The V8 engine is the primary engine used by Chrome to execute JavaScript, making it a high-value target for attackers. Because V8 handles the fundamental logic of most modern websites, a vulnerability such as an out-of-bounds write can potentially be leveraged to compromise the browser's security boundaries. The fact that this flaw was exploited in the wild before a patch was available creates a critical risk for millions of users who may have been exposed to malicious sites.
What to Watch
Security researchers will continue to monitor for evidence of how CVE-2026-87491 was deployed in the wild and whether it was paired with other exploits to bypass the browser's sandbox. While the patch resolves the immediate weakness, the frequency of V8-related flaws suggests that the engine remains a primary battleground for browser security. Users should ensure that automatic updates are enabled to mitigate the risk of future zero-day attacks.