Google released a Chrome security update on September 9 patching 230 vulnerabilities, including CVE-2026-87491 — an actively exploited zero-day in the V8 JavaScript and WebAssembly engine. The flaw is the seventh actively exploited Chrome zero-day Google has patched in 2026, indicating sustained targeting of the browser by multiple threat actors throughout the year.
CVE-2026-87491: Out-of-Bounds Write in V8 Engine Enables Arbitrary Code Execution
CVE-2026-87491 is an out-of-bounds write vulnerability in V8, Chrome’s open-source high-performance JavaScript engine. Out-of-bounds write bugs allow attackers to write data beyond allocated memory boundaries, corrupting adjacent memory structures and enabling arbitrary code execution inside the Chrome sandbox. Attackers trigger the flaw through a crafted HTML page that causes V8 to mishandle memory during JavaScript execution.
Active Exploitation Occurred Before Patch Release
Google confirmed active exploitation of CVE-2026-87491 in the wild before patches were released, meeting the definition of a zero-day vulnerability. Attackers had working exploits and were targeting Chrome users while no patch existed. Google assigned the vulnerability a CVSS score of 8.8, categorized as medium severity, though the active exploitation and arbitrary code execution impact make it a high-priority update for Chrome users.
Seventh Chrome Zero-Day Exploited in 2026 Indicates Sustained Browser Targeting
CVE-2026-87491 is the seventh actively exploited Chrome zero-day Google has patched this year. The sustained pace of zero-day exploitation against Chrome reflects the browser’s widespread deployment, the value of browser compromise as an initial access vector, and the continued investment by threat actors in discovering and weaponizing Chrome vulnerabilities.
Sandbox Escape Risk When Chained with Additional Exploits
While CVE-2026-87491 enables arbitrary code execution inside the Chrome sandbox, attackers typically chain browser exploits with additional vulnerabilities to escape the sandbox and achieve full system compromise. The V8 out-of-bounds write provides the initial foothold, but reaching operating system-level access usually requires a second exploit targeting Chrome’s sandbox architecture or the underlying operating system kernel.
Out-of-bounds write vulnerabilities occur when code writes data beyond the allocated memory buffer, corrupting adjacent memory structures. In V8’s case, this memory corruption can be weaponized to hijack program execution flow, redirecting it to attacker-controlled code. Once attackers achieve code execution within the Chrome renderer process, they operate inside the browser’s sandbox — a restricted environment that limits access to the file system, network, and other system resources.
To move from sandboxed code execution to full system compromise, sophisticated attackers chain the browser exploit with a sandbox escape vulnerability. This second exploit targets weaknesses in Chrome’s process isolation or the operating system’s privilege separation, escalating from the restricted sandbox environment to full user-level or kernel-level access. The combination of CVE-2026-87491 with a separate sandbox escape would enable complete system compromise through a malicious website alone.
Google released the Chrome security update fixing CVE-2026-87491 alongside 229 other vulnerabilities. Users should update Chrome immediately to the latest version, as the active exploitation before patch release indicates that working exploits are in adversary hands. Google did not disclose attribution details or the specific targets of the zero-day exploitation.
The pace of Chrome zero-day exploitation in 2026 — seven actively exploited flaws patched so far — establishes Chrome as one of the most consistently targeted applications this year. Organizations should enable automatic Chrome updates, monitor for successful update deployment across managed endpoints, and consider browser isolation technologies that contain web content rendering in disposable virtual environments to limit the impact of successful browser exploits.
Organizations managing Chrome deployments through enterprise policies should prioritize rapid update distribution, particularly for users in high-risk roles who may be targeted by sophisticated adversaries. The seventh zero-day of the year establishes Chrome as a persistent target, and security teams should assume additional zero-days will emerge before year-end.
