Google Confirms a Chrome Zero-Day Is Under Attack

Google pushed a Chrome Stable channel update this week patching an out-of-bounds write vulnerability in V8, the browser’s JavaScript engine, tracked as CVE-2026-87491. In its own release notes, Google states plainly: “Google is aware that an exploit for CVE-2026-87491 exists in the wild.” The fix is rolling out to Windows, Mac and Linux users over the coming days and weeks as part of the update to Chrome 153.0.8010.36. The flaw was reported by Jihyeon Jeong of Compsec Lab at Seoul National University.

For security leaders, an actively exploited V8 bug is a reason to push the update ahead of normal patch cadence rather than waiting for it to land automatically. Chrome and Chromium-based browsers, including Edge, sit on nearly every endpoint in a typical enterprise fleet, and a working exploit for a JavaScript-engine memory bug is a common first stage in a browser-based intrusion: it gets an attacker code execution inside the renderer, the step before they need a second bug to break out of Chrome’s sandbox entirely.

One detail worth flagging for triage: Google’s own release notes rate this specific V8 bug “Medium” severity, not “High” or “Critical,” despite the confirmed in-the-wild exploitation. That gap is typical of how Chrome’s rating system works. A standalone V8 memory-corruption bug is scored on what it does in isolation, code execution inside an already-sandboxed process, not on what it becomes once chained with an undisclosed sandbox-escape bug elsewhere in the browser. Security teams that triage browser CVEs by severity label alone risk deprioritizing exactly the kind of bug most likely to be the first link in a real exploit chain.

Source: Google Chrome Releases