Google fixes yet another actively exploited Chrome zero-day (CVE-2026-87491)
Google has fixed 230 vulnerabilities in Chrome, including a zero-day flaw, CVE-2026-87491, with an in-the-wild exploit.
“Google is aware that an exploit for CVE-2026-87491 exists in the wild,” the company said in a Tuesday security advisory.
The fix has been shipped in Chrome 153.0.8010.36 and .37 for Windows and macOS and Chrome 153.0.8010.36 for Linux.
About CVE-2026-87491
CVE-2026-87491, rated Medium severity, is an out of bounds write bug in V8, Chrome’s JavaScript and WebAssembly engine, which allows “a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.”
Jihyeon Jeong of the Compsec Lab at Seoul National University reported the flaw on August 6, 2026, and earned a $2,500 bug bounty for it.
Google gave no further detail about the flaw or its exploitation in the wild, in line with its usual practice while a fix is still rolling out.
“Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed,” the company noted.
CVE-2026-87491 is the seventh actively exploited Chrome zero-day Google has patched in 2026. Earlier ones this year include CVE-2026-2441 in February, CVE-2026-3909 and CVE-2026-3910 in March, CVE-2026-5281 in April, CVE-2026-11645 in June, and CVE-2026-85046 last week.
