Actively Exploited V8 Bug Headlines Massive 230-Flaw Chrome Security Update

Google has pushed a stable-channel Chrome release that closes 230 security holes, and at least one of them is already being used against real users.

The flaw under attack is tracked as CVE-2026-87491 and sits in V8, the engine Chrome uses to run JavaScript and WebAssembly. It is an out-of-bounds write — a class of memory-corruption bug where code writes past the end of an allocated buffer — and according to the entry filed with the NIST National Vulnerability Database, a remote attacker who can get a victim to open a specially built HTML page can use it to run arbitrary code inside Chrome's sandbox. Every build before 153.0.8010.36 is affected.

Notably, Google has rated the issue only medium severity, which reflects the fact that execution is confined to the sandbox rather than escaping to the underlying operating system. In practice, attackers rarely stop there: a V8 write primitive is the kind of thing that gets chained with a second sandbox-escape bug to reach the host, so the medium label is a poor guide to how urgently the patch should be applied.

Who found it, and who is using it

The bug was reported on August 6, 2026 by Jihyeon Jeong of Compsec Lab at Seoul National University, who earned a $2,500 bounty for the disclosure.

Google says it is aware that an exploit exists in the wild, but has released nothing about the campaigns using it, the targets, or the group behind them. That silence is standard: the company routinely holds back technical detail and bug-tracker access until most of the install base has updated, and keeps the restriction in place longer if the same code exists in a shared third-party library that other projects have yet to fix.

CVE-2026-87491 is the seventh Chrome zero-day Google has patched under active exploitation in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645 and CVE-2026-85046.

Five critical bugs also fixed

Alongside the zero-day, the release resolves five flaws rated critical, four of them in WebGL:

• CVE-2026-87464 — use-after-free in WebGL
• CVE-2026-87488 — use-after-free in WebGL
• CVE-2026-87438 — out-of-bounds write in WebGL
• CVE-2026-87527 — buffer overflow in WebGL
• CVE-2026-87628 — use-after-free in Cast

Most of the update is the result of Google's own internal work: the company says it found and reported 195 of the 230 issues itself, largely through automated tooling including AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer and AFL. One high-severity use-after-free in WebPackaging, CVE-2026-87639, is credited to OpenAI Codex Security — a sign of how quickly AI-assisted bug hunting is showing up in vendor acknowledgements.

What to do now

Users on Windows and macOS should be running 153.0.8010.36 or .37; Linux users need 153.0.8010.36. Chrome downloads updates automatically, but the new build does not take effect until the browser restarts, so it is worth forcing the check via More > Help > About Google Chrome and then clicking Relaunch.

Anyone on a Chromium-based alternative — Microsoft Edge, Brave, Opera or Vivaldi — inherits the same V8 code and should install their vendor's patch as soon as it ships.