Chrome Patches a Second Exploited V8 Bug in Four Days
Security / news
Chrome Patches a Second Exploited V8 Bug in Four Days
CVE-2026-87491 is Chrome's seventh actively exploited zero-day of 2026, and Google rated it an 8.8, the identical score it has given every one of the previous six.
Google patched CVE-2026-87491, an out-of-bounds write bug in Chrome's V8 engine already under active exploitation when the fix shipped Sept. 8, the seventh actively exploited Chrome zero-day Google has patched in 2026.
Google confirmed an exploit exists in the wild but, as with the six before it, withheld technical detail, attribution and target information until patch adoption catches up, according to The Hacker News.
Four days after the last one
CVE-2026-87491 landed four days after Google shipped a fix for CVE-2026-85046, a separate V8 type confusion bug patched Sept. 4. The two are not the same flaw: 85046 was a type confusion issue, while 87491 is an out-of-bounds write, according to Security Affairs. Both, and the five zero-days Google patched earlier in 2026, sit in V8, the JavaScript and WebAssembly engine that runs untrusted code from nearly every page Chrome loads, which is why a sandbox escape there tends to travel from proof of concept to exploited quickly.
Every 2026 zero-day has scored the same 8.8
Security Affairs' tally of the year's seven exploited Chrome bugs, CVE-2026-2441 in February, CVE-2026-3909 and CVE-2026-3910 in March, CVE-2026-5281 in April, CVE-2026-11645 in June, and CVE-2026-85046 and CVE-2026-87491 in September, lists an identical 8.8 CVSS score for every one. The repetition says less about how the bugs compare to each other than about Chrome's severity rubric, which rates code-execution-capable V8 and rendering flaws High by default regardless of the specific memory-corruption class involved.
Reported for $2,500, patched for federal agencies by Sept. 23
Jihyeon Jeong of Compsec Lab at Seoul National University reported CVE-2026-87491 on Aug. 6 and received a $2,500 bounty, according to SOC Prime. Google shipped the fix in Chrome 153.0.8010.36 and .37 for Windows and Mac and 153.0.8010.36 for Linux. CISA added the bug to its Known Exploited Vulnerabilities catalog Sept. 9 and set a Sept. 23 deadline for federal civilian agencies, a two-week window that is longer than the three days CISA gave for a Fortinet firewall bug added the same day, despite both flaws carrying confirmed in-the-wild exploitation.
Chrome's 2026 pace has now outrun the cadence of authentication-bypass patches shipping elsewhere in the browser and appliance market: where a network appliance vendor might ship one exploited fix in a season, Chrome has shipped two zero-day fixes inside a single week twice in 2026, first in March and now in September. Google's own disclosure policy means the public will not learn who is behind either September exploit, or which organizations were targeted, until enough of Chrome's installed base has updated; the company gave the same answer after CVE-2026-85046 and after each of the year's other five. Users on Chrome 152 or earlier remain exposed to both September flaws until they update to 153.
The four-day-old CVE-2026-85046 fix and the new one address different bug classes in the same engine, which is also why security teams that patched immediately after the first September release still needed a second update within the week rather than getting both fixes at once.
- Feb1 CVEs
- Mar2 CVEs
- Apr1 CVEs
- Jun1 CVEs
- Sep2 CVEs
Source: Security Affairs, accessed 2026-09-14
Sources
More in Security
- 01Cisco and Acronis Share a CISA Deadline, Not a Severity ScoreOne flaw needs no password and no user interaction, the other needs an attacker already logged in, and CISA gave federal agencies the same three days to fix both.
- 02Bransys ELD App Shipped With Hardcoded Login CredentialsCISA disclosed three flaws Sept. 17 in the trucking compliance app, including a hardcoded password a researcher says exposed live location and engine data from every connected truck on a subset of fleets.
- 03MikroTik Patches RouterOS Flaws Attackers Exploited FirstPoland's national CERT says attackers began exploiting the chained flaws on Sept. 2, a day before MikroTik shipped a fix, and more than 122,500 routers were still reachable a week later.
- 04Attackers Exploit a JFrog Artifactory Bug in Four DayswatchTowr says attackers began minting administrator tokens by abusing a default empty join key, CVE-2026-82329, within days of JFrog's own patch shipping.