Google Chrome Zero-day Vulnerability Exploited in the Wild (CVE-2026-87491)
Google patched actively exploited Chrome V8 out-of-bounds write CVE-2026-87491; CISA added it to KEV with a September 23 patch deadline.
Google fixed 230 Chrome vulnerabilities in its stable channel update, including CVE-2026-87491, an out-of-bounds write in the V8 JavaScript engine being exploited in the wild. The flaw, reported by Jihyeon Jeong of Compsec Lab, Seoul National University, is the seventh Chrome zero-day patched by Google in 2026. It affects Chrome versions before 153.0.8010.36, and CISA added it to the Known Exploited Vulnerabilities Catalog urging patching before September 23, 2026. Users should upgrade to Chrome 153.0.8010.36 (Linux) or 153.0.8010.36/.37 (Windows/Mac); Qualys customers can detect vulnerable assets with QID 388666.
- CVE-2026-87491 is an out-of-bounds write in V8, actively exploited and added to CISA's KEV catalog
- Seventh Chrome zero-day patched in 2026, part of a 230-vulnerability stable channel release
- Fixed in Chrome 153.0.8010.36 (Linux) and 153.0.8010.36/.37 (Windows/Mac)
- CISA set a September 23, 2026 patching deadline; Qualys detection via QID 388666
- Products
- Google ChromeV8
- Organizations
- Compsec Lab, Seoul National University
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-11645 | Out-of-Bounds Read/Write in Google Chrome V8 Enables In-Sandbox Code Execution | 8.8 | 2% | KEVPoC | KEV |
| CVE-2026-2441 | Use-After-Free in Google Chromium CSS Rendering Exposes Chrome, Edge, Opera Users | 8.8 | 55% | KEVPoC | KEV |
| CVE-2026-3909 | Out-of-Bounds Write in Google Chrome's Skia Rendering Engine | 8.8 | 2% | KEV | KEV |
| CVE-2026-3910 | Out-of-Bounds Memory Flaw in Google Chrome V8 Allows Sandboxed Code Execution | 8.8 | 3% | KEV | KEV |
| CVE-2026-5281 | Use-After-Free in Google Chrome's Dawn (WebGPU) Component Enables Arbitrary Code Execution | 8.8 | 14% | KEV | KEV |
| CVE-2026-85046 | Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046) | 8.8 | 2% | KEVPoC ×6 | KEV |
| CVE-2026-87491 | Actively Exploited Out-of-Bounds Write in Google Chrome V8 | 8.8 | 4% | KEV | KEV |
From the original article
1 min read at threatprotect.qualys.comGoogle released security updates to address 230 vulnerabilities impacting the Chrome browser. One of these vulnerabilities, tracked as CVE-2026-87491, is being exploited in the wild. This is an out-of-bounds write vulnerability in the V8 JavaScript engine.
By Diksha Ojha · threatprotect.qualys.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.