Chrome's 7th Zero-Day of 2026 — Why V8 Keeps Getting Hit, and What to Actually Do
Google patched its seventh actively-exploited Chrome zero-day of 2026, the fourth in the V8 engine alone. Here is the pattern, and the concrete steps that actually matter.
The short answer
CVE-2026-87491 is an out-of-bounds write in V8 that let a crafted webpage execute arbitrary code inside Chrome's sandbox, and Google shipped a fix in Chrome 153 two days after the August 6 report, even though exploitation had already begun. It is Chrome's seventh exploited zero-day of 2026 and the fourth located in V8. Update to 153.0.8010.36 or later, and remember that every Chromium-based browser shares that engine and needs its own patch.
Google patched Chrome’s seventh actively-exploited zero-day of 2026 this week — and the specific number matters less than the pattern behind it: four of those seven sit in the exact same component.
What was actually patched
CVE-2026-87491, an out-of-bounds write bug in V8 (Chrome’s JavaScript and WebAssembly engine), let a malicious or specially-crafted webpage execute arbitrary code inside Chrome’s sandbox. It was reported by an external researcher, Jihyeon Jeong of Compsec Lab at Seoul National University, on August 6, and Google shipped a fix in Chrome 153 (153.0.8010.36 on Linux, 153.0.8010.36/.37 on Windows and macOS) just two days after the report — while the bug was already being exploited in the wild before Google was even aware of it. CISA added it to its Known Exploited Vulnerabilities catalog the same day, with a September 23 remediation deadline for federal agencies.
This is the second Chrome zero-day patched in under a week. CVE-2026-85046, another V8 flaw — this one a type confusion bug — was patched just five days earlier, on September 3.
The pattern worth actually noticing
Here’s the full list of Chrome’s exploited zero-days in 2026 so far:
- February — CVE-2026-2441, use-after-free in CSS
- March — CVE-2026-3909, out-of-bounds write in the Skia graphics library, and CVE-2026-3910, a V8 flaw
- April — CVE-2026-5281, use-after-free in Dawn (the WebGPU component)
- June — CVE-2026-11645, out-of-bounds memory access in V8
- September — CVE-2026-85046, V8 type confusion, and CVE-2026-87491, V8 out-of-bounds write
Four of the seven sit specifically in V8. That’s not a coincidence — V8 is the component that executes untrusted JavaScript from every webpage you open, which makes it the highest-value target in the browser for both commercial exploit vendors and state-linked actors. A working exploit chain there reaches literally anyone who visits a malicious page, no additional social engineering required.
Why Google isn’t saying who’s exploiting it
Google’s advisories for actively-exploited bugs are consistently sparse on detail — no attribution, no target information, no exploitation method. This is deliberate, not evasive: disclosing specifics before most users have patched gives copycat attackers a roadmap to reverse-engineer the bug from the fix itself. The practical window where this matters most is the next several days after a patch ships, before the update fully propagates.
What to actually do
- Update Chrome now, don’t wait for auto-update. Check
chrome://settings/help— it should show you’re on 153.0.8010.36 or later. If it’s not auto-updating for some reason, that’s the actual security-relevant gap to fix, not just this one CVE. - This applies beyond Chrome itself. Any Chromium-based browser — Edge, Brave, Opera, and others — shares the V8 engine and needs the equivalent patch from its own vendor. Don’t assume you’re safe just because you don’t use Chrome by name.
- If you manage browsers across an organization, treat the September 23 CISA deadline as a practical target even if you’re not a federal agency bound by it — it’s a reasonable, externally-validated urgency signal for a patch that’s already confirmed under active exploitation.
Why this matters if you build web software, not just browse
If your product runs any user-supplied or third-party JavaScript in a browser context — embedded widgets, user-generated content with script execution, ad networks, iframes from partners — this pattern is a reminder that the browser sandbox is a real but not infinite trust boundary. V8 bugs specifically are what let a sandbox escape happen in the first place; the sandbox is the thing standing between “malicious page runs some JS” and “malicious page executes arbitrary code on the user’s machine.” A concentration of bugs in the exact component responsible for that boundary is worth factoring into any risk assessment involving embedded or third-party script execution on your own site.
Official reference: Google’s Chrome Releases blog and the NIST National Vulnerability Database entry for CVE-2026-87491, cross-checked against reporting from The Hacker News, SecurityWeek, and CISA’s Known Exploited Vulnerabilities catalog as of September 9-10, 2026.
Frequently asked questions
- Which Chrome zero-day was patched in September 2026?
- CVE-2026-87491, an out-of-bounds write in the V8 engine reported by Jihyeon Jeong of Compsec Lab at Seoul National University on August 6, was fixed in Chrome 153 (153.0.8010.36). Google shipped the fix two days after the report even though the bug was already being exploited, and CISA added it to its Known Exploited Vulnerabilities catalog the same day with a September 23 remediation deadline.
- Why do so many Chrome zero-days land in the V8 engine?
- Four of the seven exploited Chrome zero-days in 2026 sit in V8, the component that executes untrusted JavaScript from every page you open, which makes it the highest-value target in the browser for commercial exploit vendors and state-linked actors. A working exploit chain there reaches anyone who visits a malicious page, with no extra social engineering required.
- Does this Chrome zero-day affect Edge, Brave, or Opera?
- Yes. Chromium-based browsers such as Edge, Brave, and Opera share the V8 engine, so each needs the equivalent patch from its own vendor rather than inheriting Chrome's fix. The practical check is your version number: 153.0.8010.36 or later for Chrome, and the corresponding release for every other Chromium browser you run.
