Google on Thursday released updates to patch 230 security vulnerabilities, including one that has come under active exploitation in the wild.
CVE-2026-87491: an out-of-bounds write in V8
The most notable entry in the update is a medium-severity vulnerability tracked as CVE-2026-87491, described by the NIST National Vulnerability Database as an "out-of-bounds write in V8 in Google Chrome prior to 153.0.8010.36" that "allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page." Google acknowledged it is "aware that an exploit for CVE-2026-87491 exists in the wild," but did not provide additional details about how the flaw is being weaponized or who is using the exploit.
The vulnerability was reported by security researcher Jihyeon Jeong of Compsec Lab, Seoul National University, on August 6, 2026; Jeong received a $2,500 bug bounty reward for the responsible disclosure.
Google's September release: 230 fixes and seven actively exploited zero-days this year
The September update covers 230 security flaws in Chrome. Google reported 195 of those issues internally, according to its published notes. With this release, Google has addressed a total of seven Chrome zero-days that the company says were actively exploited since the start of the year, including CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, CVE-2026-85046, and now CVE-2026-87491.
Google's public acknowledgement that an exploit exists in the wild follows prior practice: "Access to bug details and links may be kept restricted until a majority of users are updated with a fix," the company said, and added it will "retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed."
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildFive critical WebGL and Cast flaws fixed alongside the V8 zero-day
- CVE-2026-87464 — Use-after-free in WebGL
- CVE-2026-87488 — Use-after-free in WebGL
- CVE-2026-87438 — Out-of-bounds write in WebGL
- CVE-2026-87527 — Buffer overflow in WebGL
- CVE-2026-87628 — Use-after-free in Cast
Google characterized these WebGL and Cast issues as critical and included them in the same patch bundle as CVE-2026-87491. One additional high use-after-free flaw in WebPackaging, CVE-2026-87639, is credited to OpenAI Codex Security.
How Google finds bugs and how it is managing disclosure
Google noted that many of the security bugs it finds are detected using automated and instrumentation tools, specifically listing AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL. The company’s disclosure guidance in this release reiterates a staged approach: information about bugs may remain restricted until a majority of users have updated and until dependent third-party libraries are also patched.
What this means for technologists, end users, and Chromium-based browser vendors
Technologists and security teams: Prioritize deployment of the Chrome updates to reduce exposure to an exploit Google says exists in the wild. Google’s fixed builds are 153.0.8010.36/.37 for Windows and Apple macOS, and 153.0.8010.36 for Linux; administrators can confirm updates by navigating in Chrome to More > Help > About Google Chrome and selecting Relaunch.
End users and the general public: Apply the update through Chrome’s normal update path. Google’s advisory explicitly recommends updating the browser and using the Relaunch option in About Google Chrome to ensure the latest fixes are installed.
Chromium-based browser vendors (Microsoft Edge, Brave, Opera, Vivaldi): The company advised users of other Chromium-based browsers to "also apply the fixes as and when they become available," underscoring that these patches depend on each vendor integrating Chrome’s changes into their own release cycles.
The immediate facts are straightforward: an actively exploited out-of-bounds write in V8 has been fixed, Google has issued a broad patch covering 230 flaws, and the company is continuing to restrict detailed bug information until patches are widely deployed or third-party dependencies are fixed. Whether other Chromium forks will ship the same fixes quickly, and how exploit activity will change in response, are near-term questions driven by those deployment timelines and disclosure restrictions.
