Google Patches Actively Exploited Chrome V8 Zero-Day Among 230 Vulnerabilities
Summary
Google patched 230 Chrome vulnerabilities, including actively exploited V8 flaw CVE-2026-87491. Updated versions are available for Windows, macOS, and Linux; users of Chromium-based browsers should apply fixes when available.
Key points
- Google says CVE-2026-87491, an out-of-bounds write in Chrome’s V8 engine, is being exploited in the wild.
- A crafted HTML page could allow remote code execution inside the sandbox in Chrome versions before 153.0.8010.36.
- Google has not disclosed details about the real-world exploitation or who is behind it.
- The update fixes 230 vulnerabilities, including five critical flaws in WebGL and Cast and a high-severity WebPackaging flaw.
- Google recommends Chrome 153.0.8010.36/.37 for Windows and macOS and 153.0.8010.36 for Linux.
- Users of Chromium-based browsers, including Edge, Brave, Opera, and Vivaldi, should apply fixes when available.
Article Details
- Vulnerability Types
- Out-of-bounds write
- Severity
- Medium
- Affected Versions
- Google Chrome versions prior to 153.0.8010.36
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Update Chrome to version 153.0.8010.36 or later on Linux, or version 153.0.8010.36 or 153.0.8010.37 on Windows and macOS.
MITRE ATT&CK
CVE
CVE-2026-87438CVE-2026-87438 – Out-of-bounds write in WebGLCVE-2026-87464CVE-2026-87464 – Use-after-free in WebGLCVE-2026-87488CVE-2026-87488 – Use-after-free in WebGLCVE-2026-87491Google has released updates to fix 230 security vulnerabilities in Chrome, including CVE-2026-87491, a V8 out-of-bounds write flaw that is already being exploited in the wild.CVE-2026-87527CVE-2026-87527 – Buffer overflow in WebGLCVE-2026-87628CVE-2026-87628 – Use-after-free in CastCVE-2026-87639One high use-after-free flaw in WebPackaging (CVE-2026-87639) is credited to OpenAI Codex Security.
People
Vendors
Products
CastThe update also addresses several critical issues in WebGL, Cast, and WebPackaging, and users are urged to update Chrome immediately for protection.Google ChromeGoogle has released updates to fix 230 security vulnerabilities in Chrome, including CVE-2026-87491, a V8 out-of-bounds write flaw that is already being exploited in the wild.V8Google has released updates to fix 230 security vulnerabilities in Chrome, including CVE-2026-87491, a V8 out-of-bounds write flaw that is already being exploited in the wild.WebGLThe update also addresses several critical issues in WebGL, Cast, and WebPackaging, and users are urged to update Chrome immediately for protection.WebPackagingThe update also addresses several critical issues in WebGL, Cast, and WebPackaging, and users are urged to update Chrome immediately for protection.
Tools
AddressSanitizer“Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL,” the company added.AFL“Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL,” the company added.Control Flow Integrity“Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL,” the company added.libFuzzer“Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL,” the company added.MemorySanitizer“Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL,” the company added.UndefinedBehaviorSanitizer“Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL,” the company added.