CVE-2026-87491 is an out-of-bounds write vulnerability in V8, the JavaScript and WebAssembly engine at the core of Google Chrome and every Chromium-based browser, allowing a remote attacker to execute arbitrary code inside Chrome's sandbox simply by getting a victim to open a specially crafted HTML page. This is the seventh actively-exploited Chrome zero-day patched in 2026.

The following version(s) are affected:

Google Chrome prior to 153.0.8010.36 (Windows, Linux) – (Affected)
Google Chrome prior to 153.0.8010.37 (macOS) – (Affected)

Google Chrome 153.0.8010.36/.37 (Windows/macOS) and 153.0.8010.36 (Linux) and later – (Not affected, patched)

Step 1 - Lure a victim to a malicious or compromised webpage

An attacker delivers a link to a specially crafted HTML page to the victim – for example via a phishing email, a malicious advertisement, or a compromised legitimate website, and the victim opens it in an affected version of Chrome or a Chromium-based browser.

Step 2 - Trigger the V8 out-of-bounds write to execute code inside the browser sandbox

JavaScript on the malicious page triggers the out-of-bounds write bug in V8, giving the attacker the ability to corrupt memory and execute attacker-controlled code inside Chrome's sandboxed renderer process, without any further action from the victim.

Attack vectors:

• A web-based attack requiring only that the victim visit a malicious or compromised webpage in an affected browser – no file download, credential entry, or software installation is needed.
• Google has confirmed an exploit for this vulnerability exists and is being exploited in the wild.

Successful exploitation may allow attackers to:

• Execute arbitrary code inside the Chrome sandbox on the victim's device simply by getting them to view a malicious webpage, with no further interaction required.
• Access data and session activity within the compromised browser process, and potentially pursue a further sandbox-escape exploit chain to gain broader access to the underlying device, depending on the attacker's capability and objectives.

CERTVU recommends the following:

1. Apply the vendor patch immediately, given confirmed active exploitation

   Update Google Chrome to version 153.0.8010.36/.37 (Windows/macOS) or 153.0.8010.36 (Linux) or later, via chrome://settings/help, and fully restart the browser to complete the update. Given active exploitation, treat this as an emergency update rather than routine patching.

2. Update every Chromium-based browser, not just Chrome itself

3. Audit the estate for devices still running an outdated Chrome version

4. Review activity for signs of compromise on any device that may have been exposed

Report any suspected compromise arising from this vulnerability to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.