A security vulnerability, identified as CVE-2026-87491, has been discovered in the V8 JavaScript and WebAssembly engine used by Google Chrome. The vulnerability is caused by an out-of-bounds write issue and could allow a remote attacker to execute arbitrary code within the browser sandbox by persuading a user to visit a specially crafted webpage. Successful exploitation provides an entry point that could be chained with a separate sandbox-escape vulnerability for full system compromise. Google has confirmed that an exploit for this vulnerability exists in the wild.

System owners and users are strongly advised to update Google Chrome to latest version to reduce potential risks.

Vulnerability

• Google Chrome V8 Out-of-Bounds Write Zero-Day Vulnerability (CVE-2026-87491)

Severity Level

• High

Affected Versions

• Google Chrome prior to 153.0.8010.36 (Linux)
• Google Chrome prior to 153.0.8010.36/.37 (Windows / macOS)

Remediation

• Update Google Chrome to the latest available version.
  • In Chrome, navigate to:
    • Settings > About Chrome
  • Chrome will automatically check for and install available udpates.
  • Relaunch the browser when prompted to complete the update.
• Verify the installed browser version after updating.
  • Ensure that Google Chrome is running version 153.0.8010.36 or later.
• Update Other Chromium-based browsers.
  • Users of Microsoft Edge, Brave, Opera, Vivaldi or other Chromium-based browsers should check for and apply the latest security updates provided by the respective vendors.

Reference

• NVD: CVE-2026-87491
• HKCERT: Google Chrome Multiple Vulnerabilities
• GovCERT.HK: High Threat Security Alert (A26-09-12): Multiple Vulnerabilities in Google Chrome
• Chrome Releases: Stable Channel Update for Desktop
• Tenable: CVE-2026-87491
• The Hacker News: Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox

Published on: 10 Sep 2026