Chrome’s Latest Zero-Day is Already Being Exploited

You don’t have to download a suspicious file to be attacked. Sometimes, opening the wrong web page is enough. Google has released an urgent Chrome security update after confirming that attackers are actively exploiting a newly discovered zero-day vulnerability in Chrome’s V8 engine.

Tracked as CVE-2026-87491, the vulnerability affects the part of Chrome responsible for processing JavaScript and WebAssembly which are the technologies used by almost every modern website. The flaw can allow an attacker to run malicious code inside Chrome’s security sandbox simply by getting a victim to load a specially crafted web page.

The incident is particularly concerning because this is not just a theoretical vulnerability. Google has confirmed that an exploit already exists in the wild.

What Happened?

The vulnerability is an out-of-bounds write in Chrome’s V8 engine. Chrome can be tricked into writing information outside the area of computer memory it was supposed to use. When carefully exploited, this memory error can give an attacker the ability to execute their own code.

The vulnerability affects Chrome versions before 153.0.8010.36 and was assigned CVE-2026-87491. Google classified it as Medium severity, but other vulnerability databases have assigned it a CVSS 3.1 score of 8.8 (High) because successful exploitation can affect the confidentiality, integrity and availability of the affected system.

How Could an Attack Work?

The attack does not necessarily require a victim to install software. The attacker would need the victim to load specially crafted web content. Once triggered, the vulnerability can allow arbitrary code execution within Chrome's sandbox.

This does not mean that every person who visits a website will automatically have their computer taken over. The attacker still needs a working exploit and the victim must encounter the malicious content. However, the fact that the vulnerability is already being exploited makes the risk more immediate.

Chrome 153 fixes more than the Zero-Day

The zero-day was addressed as part of Chrome's latest security release, which fixes 230 security vulnerabilities.

Among them are five Critical vulnerabilities affecting components including WebGL and Cast, alongside dozens of High-severity issues. Google has released:

• Windows: Chrome 153.0.8010.36/.37

• macOS: Chrome 153.0.8010.36/.37

• Linux: Chrome 153.0.8010.36

Recommendations

• Update Chrome immediately to version 153.0.8010.36/.37 or later, depending on your operating system.

• Restart the browser after updating to ensure the security fixes are active.

• Avoid opening suspicious links, advertisements or unfamiliar websites, particularly when using an outdated browser.

• Prioritise CVE-2026-87491 as an actively exploited vulnerability in vulnerability-management programmes.

• Use endpoint management tools to identify outdated Chrome and Chromium-based browsers across the organisation.

• Ensure Chrome updates are automatically deployed, and users cannot remain on vulnerable versions.

• Where suspicious browser activity is identified, investigate the endpoint rather than assuming that updating alone resolves a potentially existing compromise.

esentry continues to monitor emerging vulnerabilities and active exploitation campaigns to help organisations understand, prioritise and respond to threats before they become larger incidents.

‍