Google Fixes Chrome Zero-Day Exploited in the Wild

Google has released a major security update for Chrome after confirming that attackers are actively exploiting a high-severity zero-day vulnerability in the browser.

The flaw, tracked as CVE-2026-87491, affects Chrome’s V8 JavaScript and WebAssembly engine. Google says an exploit for the vulnerability already exists in the wild, making the update particularly important for Chrome users.

The vulnerability is one of seven Chrome zero-days that Google has addressed after confirming exploitation in attacks during 2026.

Chrome Users Should Install the Latest Update

Google has started distributing patched versions of Chrome through its Stable Desktop channel.

The updated versions are:

• Windows: Chrome 153.0.8010.36
• macOS: Chrome 153.0.8010.37
• Linux: Chrome 153.0.8010.36

Google says the update may take several days or weeks to reach all users. However, users can check for the update manually rather than waiting for the browser to receive it automatically.

Chrome can also download and install updates automatically, with the installation generally taking effect after the browser is restarted.

Keeping Chrome updated is only one part of protecting your online accounts. Users should also enable two-factor authentication wherever it is available, adding another layer of protection if an attacker manages to steal a password or compromise a device.

Because Google has confirmed active exploitation, users should not delay updating if a newer version is available.

The Vulnerability Is Located in Chrome’s V8 Engine

CVE-2026-87491 is an out-of-bounds write vulnerability affecting V8, the engine Chrome uses to execute JavaScript and WebAssembly.

An out-of-bounds write occurs when software writes data outside the memory area allocated for a particular operation. Depending on how the vulnerability can be triggered, this type of memory-safety flaw can potentially result in crashes, corruption of data, or arbitrary code execution.

In this case, Google says a remote attacker could potentially exploit the vulnerability through a specially crafted HTML page.

Successful exploitation could allow an attacker to manipulate browser memory and potentially execute code within Chrome’s sandbox.

The possibility of escaping or bypassing security boundaries is one reason vulnerabilities in browser engines are treated particularly seriously.

Google Has Confirmed Exploitation but Released Few Details

Google has confirmed that exploits for CVE-2026-87491 are being used in attacks, but the company has not yet disclosed detailed information about how those attacks work or who is behind them.

This limited disclosure is intentional.

Google says access to detailed vulnerability information and related links may remain restricted until a majority of users have installed the security fix.

Keeping technical details private can make it harder for additional attackers to reproduce the exploit while vulnerable systems are still being updated.

This approach is especially important for zero-day vulnerabilities because attackers may already have working exploitation techniques before a patch becomes widely available.

This Is Chrome’s Seventh Exploited Zero-Day of 2026

The newly patched vulnerability is not an isolated incident.

Google has already addressed several other Chrome vulnerabilities that were confirmed to have been exploited during attacks this year.

Earlier in 2026, attackers exploited a vulnerability identified as CVE-2026-2441, an iterator invalidation flaw affecting Chrome’s CSS font feature implementation.

Two additional vulnerabilities were addressed in March. CVE-2026-3909 was an out-of-bounds write vulnerability in the Skia graphics library, while CVE-2026-3910 affected the V8 JavaScript and WebAssembly engine.

Google later fixed CVE-2026-5281, a use-after-free vulnerability in Dawn, the implementation of the WebGPU standard used by Chromium.

Earlier in September, Google also patched CVE-2026-85046, a type confusion vulnerability in V8.

The latest vulnerability brings the number of Chrome zero-days confirmed as exploited in attacks this year to seven.

Why Browser Zero-Days Are So Dangerous

Web browsers are attractive targets because they process content from almost every part of the internet.

A malicious webpage, compromised website, or specially crafted piece of web content can potentially expose vulnerable browser components to an attacker without requiring traditional malware to be installed first.

Browser engines are also extremely complex. Chrome must process JavaScript, WebAssembly, images, video, fonts, graphics, networking protocols, and countless other types of content.

That complexity creates a large attack surface.

A memory-safety vulnerability inside an engine such as V8 can therefore become particularly valuable to attackers, especially when it can be combined with other vulnerabilities to escape security restrictions or gain additional privileges.

Chrome’s Sandbox Provides an Additional Security Layer

Chrome does not simply allow web content to execute with unrestricted access to the operating system.

The browser uses sandboxing to isolate potentially dangerous processes from the rest of the system. This is designed to limit what an attacker can do even if they successfully exploit a browser vulnerability.

However, attackers can attempt to chain multiple vulnerabilities together.

For example, an attacker could potentially use one vulnerability to gain code execution inside a browser process and then rely on another weakness to escape the sandbox.

This is one reason security researchers and browser vendors pay close attention to vulnerabilities affecting core browser components.

What Chrome Users Should Do

The most important action for Chrome users is simple: update the browser.

On desktop systems, users can check Chrome’s update status through the browser’s settings and restart Chrome if an update has been downloaded but not yet installed.

Users should also be cautious when visiting unfamiliar websites or opening links received through unexpected messages.

While Google has confirmed that CVE-2026-87491 is being exploited, the company has not publicly provided enough information to determine exactly how widespread the attacks are or which groups are responsible.

Until more details become available, keeping Chrome fully updated remains the strongest practical defense for ordinary users.

Google Is Keeping Exploit Details Restricted

The decision to limit technical information surrounding the vulnerability is common when a security flaw is being actively exploited.

Detailed exploit information can be extremely useful to security researchers trying to understand and defend against an attack. But the same information can also help additional attackers reproduce the vulnerability before users have had enough time to install the patch.

Google therefore plans to maintain restrictions while the update is being distributed.

Once enough users have installed the fix and the immediate risk has decreased, additional technical information may become available.

The Growing Zero-Day Problem

The latest Chrome vulnerability also highlights a broader problem facing modern browsers.

Google patched eight Chrome zero-days that were exploited in attacks during 2025, and the company has now confirmed seven such vulnerabilities during 2026.

Zero-days are particularly difficult to defend against because they can be exploited before the broader security community has a chance to develop protections.

Browser vendors have responded by improving sandboxing, vulnerability detection, exploit mitigations, automatic updates, and security research programs.

Nevertheless, the continued discovery and exploitation of browser zero-days shows that attackers remain highly interested in finding weaknesses inside widely used software.

For Chrome users, the lesson is straightforward: browser updates are a critical part of everyday security, especially when a vendor confirms that a vulnerability is already being exploited.

Source: BleepingComputer

Google Chrome Security Update: Chrome Releases

CVE details: NIST National Vulnerability Database