Google Patches Seventh Chrome Zero-Day of 2026 Exploited in the Wild (CVE-2026-87491)
By DigitalSpying Threat Research Team
Published: September 10, 2026
Target: Enterprise IT, Endpoint Security, SecOps, Browser Governance
Executive Summary
On September 8, 2026, Google promoted Chrome 153 to the Stable channel, releasing emergency security fixes across Windows, macOS, and Linux that resolve an actively exploited zero-day vulnerability in the V8 JavaScript and WebAssembly rendering engine. Designated as CVE-2026-87491, the flaw is an out-of-bounds write condition that allows remote threat actors to achieve arbitrary memory corruption and execute malicious code inside the browser process simply by luring a victim to a specially crafted webpage.
CVE-2026-87491 marks the seventh zero-day vulnerability patched in Google Chrome since the start of 2026, underscoring relentless adversary targeting of high-performance client-side rendering engines. Google acknowledged that an exploit for CVE-2026-87491 already exists in the wild and has been utilized in targeted surveillance campaigns. Enterprise security teams and individual users are urged to verify that all desktop Chrome installations are updated to version 153.0.8010.36/.37 or newer without delay.
Technical Analysis of the V8 Out-of-Bounds Write
The vulnerability was discovered and responsibly reported to Google on August 6, 2026, by Jihyeon Jeong of Compsec Lab at Seoul National University.+-----------------------------------------------------------------------------------+
| Chrome V8 Exploit Flow (CVE-2026-87491) |
|---|+-----------------------------------------------------------------------------------+
| |
| [Attacker Web Server] |
| | |
| | 1. Serves malicious HTML / JavaScript |
| v |
| [Victim Browser: Chrome < 153.0.8010.36] |
| | |
| | 2. V8 TurboFan JIT Engine compiles optimized WebAssembly/JS loop |
| v |
| [Type Confusion / Array Boundary Miscalculation] |
| | |
| | 3. Out-of-Bounds memory write beyond allocated array buffer |
| v |
| [Heap Corruption / Memory Pointer Overwrite] |
| | |
| | 4. Arbitrary Shellcode Execution inside Renderer Sandbox |
| v |
| [Secondary Sandbox Escape / OS Takeover (if chained)] |
| |
+-----------------------------------------------------------------------------------+
Mechanism of the Out-of-Bounds Write
The vulnerability resides in the way V8's just-in-time (JIT) optimization compiler (TurboFan) optimizes operations involving typed arrays and WebAssembly linear memory buffers. Under specific conditions, a logic error in JIT range analysis allows malicious JavaScript code to bypass boundary checks:
1. An attacker crafts an HTML page containing an obfuscated JavaScript routine that declares a dynamic array structure.
2. The JIT compiler speculatively assumes that indices accessing the memory buffer will remain within predetermined bounds, omitting runtime boundary checks in the generated machine code.
3. By triggering an unexpected type conversion or index overflow, the exploit forces the engine to write raw bytes to memory addresses outside the buffer's allocated heap boundary.
4. This out-of-bounds memory write corrupts adjacent object pointers and function dispatch tables, enabling the attacker to gain reliable read/write primitives across the renderer process space and execute arbitrary shellcode.
Chaining with Sandbox Escapes
While CVE-2026-87491 executes within the confines of Chrome's multi-process sandbox architecture, threat actors frequently chain browser renderer zero-days with Windows or macOS operating system kernel privilege escalation flaws (such as recent Win32k or profile service flaws) to escape the sandbox entirely and achieve full system compromise.
The 2026 Chrome Zero-Day Landscape
The disclosure of CVE-2026-87491 represents the seventh zero-day exploit neutralized in Google Chrome during 2026:
Vulnerability
Component
Description
Disclosure Date
CVE-2026-11824
V8 Engine
Type confusion in JIT optimization
Jan 2026
CVE-2026-22485
WebGPU
Memory corruption in graphics driver interface
Mar 2026
CVE-2026-38491
WebAudio
Use-after-free in audio stream buffer
May 2026
CVE-2026-51203
Skia 2D
Out-of-bounds write in font rendering
Jun 2026
CVE-2026-62184
Dawn WebGPU
Buffer overflow in shader compiler
Jul 2026
CVE-2026-77319
V8 Engine
Use-after-free in object allocation
Aug 2026
CVE-2026-87491
V8 Engine
Out-of-bounds write in array handling
Sept 2026
The clustering of zero-days around V8 demonstrates that advanced threat actors—particularly commercial spyware vendors and state-sponsored espionage syndicates—continue to prioritize browser engines as their primary vector for zero-click and one-click remote compromise.
Enterprise Defense & Recommended Actions
1. Immediate Patch Deployment
Network and desktop administrators should enforce the immediate rollout of the updated Chrome build:
* Windows & macOS: Chrome version 153.0.8010.36 or 153.0.8010.37
* Linux: Chrome version 153.0.8010.36
* Chromium Ecosystem: Verify upstream updates for Microsoft Edge, Brave, Opera, and Vivaldi as vendor patches are published.
2. Mandatory Browser Restart
Remind users that Chrome updates downloaded in the background do not take effect until the browser application is completely restarted. IT administrators can enforce restart policies via Google Workspace Enterprise Admin controls (RelaunchNotification and RelaunchWindow policies).
3. Enable Chrome Enterprise Core & V8 Sandbox
Organizations utilizing Chrome Enterprise should ensure that the V8 Sandbox (a lightweight software security boundary designed to prevent memory corruptions within V8 from escaping into process memory) remains enabled and unconstrained by legacy application extensions.