In September 2026, Google shipped an emergency Chrome update fixing a critical flaw tracked as CVE-2026-87491. It’s the seventh Chrome vulnerability this year that attackers actively exploited before Google could patch it — a sharp reminder that your website’s security depends not only on your own stack, but on the browsers your visitors use.
What the flaw actually allows
CVE-2026-87491 is an out-of-bounds write bug in V8, the engine that powers JavaScript and WebAssembly in Chrome. In plain terms, the browser writes data outside its allocated memory during certain operations, which attackers can abuse to execute arbitrary code inside the browser’s sandbox. All it takes is convincing a user to open a specially crafted HTML page — no attachment, no download required.
The flaw was reported in early August by researcher Jihyeon Jeong of the Compsec Lab at Seoul National University, who earned a $2,500 bounty for it. Google has since confirmed that a working exploit already exists in the wild, which is why the patch shipped within days rather than the usual weeks.
Who needs to act
The bug affects Chrome versions before 153.0.8010.36. Because several other browsers — Microsoft Edge, Brave, Opera, Vivaldi — are built on the same Chromium engine, similar patches are likely to follow from those vendors too. CISA, the US cybersecurity agency, has told organizations to remediate by September 23, 2026 — an unusually tight deadline, but a justified one given active exploitation.
For anyone running a website, there are two takeaways. First: if you manage company machines or recommend a specific browser to staff, confirm the update actually reached every device, not just a handful. Chrome usually updates itself silently in the background, but applying the fix requires a restart — something people routinely postpone for weeks.
Second: even a flawlessly secured website can’t protect a visitor who opens a link in an outdated browser compromised through an unrelated site or ad network. Website security today spans the whole chain, from the server and CMS all the way to the visitor’s own device.
Seven zero-days in a year — why the number keeps climbing
The fact that this is Chrome’s seventh zero-day of 2026 isn’t a coincidence. V8 is an extremely complex engine that keeps changing to squeeze out performance and support new JavaScript features, and every memory optimization carries some risk of bugs like this one. At the same time, bug bounty rewards for zero-days keep rising, which drives researchers to hunt for them actively — and to disclose them right when an exploit is actually being used against real targets.
Conclusion
Updating your browser is one of the cheapest and most effective security measures there is, yet companies and individuals routinely neglect it. If you manage a website or company IT and aren’t sure this patch has reached every machine, now is the time to check. Need help with a security audit of your website or company workstations? Get in touch — we’ll take care of it for you.
