Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox
Google patches actively exploited Chrome V8 zero-day CVE-2026-87491, an out-of-bounds write enabling sandboxed code execution via crafted HTML pages.
Google released Chrome 153.0.8010.36/.37 fixing 230 vulnerabilities, including CVE-2026-87491, an out-of-bounds write in the V8 engine that allowed remote code execution inside the sandbox via a crafted HTML page and is confirmed to be exploited in the wild. The flaw was reported on August 6, 2026 by Jihyeon Jeong of Compsec Lab, Seoul National University, who received a $2,500 bug bounty. This is the seventh actively exploited Chrome zero-day of 2026. The update also fixes five critical flaws in WebGL and Cast, plus a high WebPackaging use-after-free (CVE-2026-87639) credited to OpenAI Codex Security.
- Out-of-bounds write in V8; fixed in Chrome 153.0.8010.36/.37
- Seventh actively exploited Chrome zero-day of 2026
- Reported by Seoul National University researcher; $2,500 bounty
- Update also fixes critical WebGL and Cast use-after-free bugs
- Chromium-based browsers like Edge and Brave should follow with fixes
- CVEs
- CVE-2026-87491CVE-2026-2441CVE-2026-3909CVE-2026-3910CVE-2026-5281CVE-2026-11645CVE-2026-85046CVE-2026-87464CVE-2026-87488CVE-2026-87438CVE-2026-87527CVE-2026-87628CVE-2026-87639
- Vendors
- Organizations
- Compsec LabSeoul National University
- AI models
- OpenAI Codex
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-11645 | Out-of-Bounds Read/Write in Google Chrome V8 Enables In-Sandbox Code Execution | 8.8 | 2% | KEVPoC | KEV |
| CVE-2026-2441 | Use-After-Free in Google Chromium CSS Rendering Exposes Chrome, Edge, Opera Users | 8.8 | 55% | KEVPoC | KEV |
| CVE-2026-3909 | Out-of-Bounds Write in Google Chrome's Skia Rendering Engine | 8.8 | 2% | KEV | KEV |
| CVE-2026-3910 | Out-of-Bounds Memory Flaw in Google Chrome V8 Allows Sandboxed Code Execution | 8.8 | 3% | KEV | KEV |
| CVE-2026-5281 | Use-After-Free in Google Chrome's Dawn (WebGPU) Component Enables Arbitrary Code Execution | 8.8 | 14% | KEV | KEV |
| CVE-2026-85046 | Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046) | 8.8 | 2% | KEVPoC ×6 | KEV |
| CVE-2026-87438 | Out-of-Bounds Write in Google Chrome for Android WebGL Enables Sandbox-Escape RCE | 9.6 group max | <1% | ||
| CVE-2026-87491 | Actively Exploited Out-of-Bounds Write in Google Chrome V8 | 8.8 | 4% | KEV | KEV |
From the original article
2 min read at thehackernews.com
Google on Thursday released updates to patch 230 security vulnerabilities, including one that has come under active exploitation in the wild. The medium-severity vulnerability, assigned the CVE identifier CVE-2026-87491 (CVSS score: N/A), has been described as an out-of-bounds bug in V8, Chrome's JavaScript and WebAssembly engine. "Out-of-bounds write in V8 in Google Chrome prior to
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.