Chrome patches seventh 2026 zero-day as V8 flaw exploited in wild

Key points

• Google patched 230 vulnerabilities on Tuesday, including the actively exploited zero-day CVE-2026-87491.
• The flaw is an out-of-bounds write weakness in the V8 JavaScript and WebAssembly engine, allowing arbitrary code execution.
• This is the seventh actively exploited Chrome zero-day patched in 2026, following CVE-2026-85046 in early September.
• Patched versions are rolling out for Windows, Mac, and Linux, but full distribution may take days or weeks.
• Google has restricted details of the exploit to ensure a majority of users are updated before public disclosure.

Background

This latest patch follows a type confusion zero-day (CVE-2026-85046) fixed in early September, which was the sixth exploited flaw of the year. Chrome has faced increased security scrutiny in 2026, with AI-driven bug discovery leading to a faster patch cadence. Earlier in the year, the browser also faced threats to passkey security on Windows, though those issues remained unexploited.

How outlets are covering it

BleepingComputer and The Hacker News both confirm the active exploitation of the new V8 flaw but differ on the specific CVEs discussed; BleepingComputer focuses on the new CVE-2026-87491, while The Hacker News details the previous CVE-2026-85046. The Independent urges immediate user action, while the Hong Kong CERT rates the risk as 'Extremely High' due to the potential for remote code execution and information disclosure.

Why it matters

Active exploitation of browser zero-days poses a direct threat to user data and system integrity. The rapid succession of exploited flaws in 2026 highlights the need for immediate updates and underscores the risks associated with the V8 engine, which is central to Chrome's functionality.

What to watch

Google will continue rolling out the patch to all users, which may take several days or weeks. The company will likely release more details about the exploit once a majority of users have updated. Users should manually check for updates to ensure they are protected.