Chrome Patches a Second Exploited V8 Bug in Four Days
Security / news
Chrome Patches a Second Exploited V8 Bug in Four Days
CVE-2026-87491 is Chrome's seventh actively exploited zero-day of 2026, and Google rated it an 8.8, the identical score it has given every one of the previous six.
Google patched CVE-2026-87491, an out-of-bounds write bug in Chrome's V8 engine already under active exploitation when the fix shipped Sept. 8, the seventh actively exploited Chrome zero-day Google has patched in 2026.
Google confirmed an exploit exists in the wild but, as with the six before it, withheld technical detail, attribution and target information until patch adoption catches up, according to The Hacker News.
Four days after the last one
CVE-2026-87491 landed four days after Google shipped a fix for CVE-2026-85046, a separate V8 type confusion bug patched Sept. 4. The two are not the same flaw: 85046 was a type confusion issue, while 87491 is an out-of-bounds write, according to Security Affairs. Both, and the five zero-days Google patched earlier in 2026, sit in V8, the JavaScript and WebAssembly engine that runs untrusted code from nearly every page Chrome loads, which is why a sandbox escape there tends to travel from proof of concept to exploited quickly.
Every 2026 zero-day has scored the same 8.8
Security Affairs' tally of the year's seven exploited Chrome bugs, CVE-2026-2441 in February, CVE-2026-3909 and CVE-2026-3910 in March, CVE-2026-5281 in April, CVE-2026-11645 in June, and CVE-2026-85046 and CVE-2026-87491 in September, lists an identical 8.8 CVSS score for every one. The repetition says less about how the bugs compare to each other than about Chrome's severity rubric, which rates code-execution-capable V8 and rendering flaws High by default regardless of the specific memory-corruption class involved.
Reported for $2,500, patched for federal agencies by Sept. 23
Jihyeon Jeong of Compsec Lab at Seoul National University reported CVE-2026-87491 on Aug. 6 and received a $2,500 bounty, according to SOC Prime. Google shipped the fix in Chrome 153.0.8010.36 and .37 for Windows and Mac and 153.0.8010.36 for Linux. CISA added the bug to its Known Exploited Vulnerabilities catalog Sept. 9 and set a Sept. 23 deadline for federal civilian agencies, a two-week window that is longer than the three days CISA gave for a Fortinet firewall bug added the same day, despite both flaws carrying confirmed in-the-wild exploitation.
Chrome's 2026 pace has now outrun the cadence of authentication-bypass patches shipping elsewhere in the browser and appliance market: where a network appliance vendor might ship one exploited fix in a season, Chrome has shipped two zero-day fixes inside a single week twice in 2026, first in March and now in September. Google's own disclosure policy means the public will not learn who is behind either September exploit, or which organizations were targeted, until enough of Chrome's installed base has updated; the company gave the same answer after CVE-2026-85046 and after each of the year's other five. Users on Chrome 152 or earlier remain exposed to both September flaws until they update to 153.
The four-day-old CVE-2026-85046 fix and the new one address different bug classes in the same engine, which is also why security teams that patched immediately after the first September release still needed a second update within the week rather than getting both fixes at once.
- Feb1 CVEs
- Mar2 CVEs
- Apr1 CVEs
- Jun1 CVEs
- Sep2 CVEs
Source: Security Affairs, accessed 2026-09-14
Sources
More in Security
- 01Go Team Weighs Turning Off Default MPTCP After Linux FlawThe Go Security Team called a default change premature on Oct. 29, while commenters on golang/go issue 82717 split over keeping multipath TCP on.
- 02Anthropic's Claude Exploit Chains Hit Five Targets, Each With LimitsThe Frontier Red Team's Oct. 27 post covers Chrome, Safari, Android, Windows and Linux, but only the Chrome and Linux results reach code execution.
- 03A Tampered Claude Code Extension Sat in Cursor's Marketplace for 11 Hours and Left an SSH Key BehindVersions 2.1.312 and 2.1.313 carried a 7,386-byte loader that plants an attacker key and a reverse tunnel. Uninstalling the extension does not remove either.
- 04Ivanti Connect Secure Zero-Day Chain Gave Root on a Patched VPN, and the Integrity Checker Misses ItVolexity dates exploitation to October 3, ten days before Ivanti's advisory; the root escalation step has no CVE and no fix in the sources reviewed.