Google shipped an emergency Chrome update fixing CVE-2026-87491, the seventh zero-day vulnerability actively exploited in the wild that the company has patched this year. The flaw is an out-of-bounds write bug in V8, Chrome's JavaScript and WebAssembly engine, and can be triggered simply by visiting a malicious web page.
The fix landed in Chrome 153.0.8010.36/.37 for Windows and macOS and 153.0.8010.36 for Linux, part of a broader release addressing 230 vulnerabilities total. Security researcher Jihyeon Jeong of Seoul National University's Compsec Lab reported the bug on August 6 and earned a $2,500 bounty.
Four of the seven Chrome zero-days patched in 2026 have been rooted in V8, underscoring how the JavaScript engine remains attackers' favorite entry point into the browser. Users are urged to update immediately, since Google typically withholds technical exploit details until a majority of users have patched.