Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox

Google patched CVE-2026-87491, a zero-day out-of-bounds write in Chrome's V8 engine actively exploited in the wild. Attackers can execute arbitrary code within the browser sandbox via crafted HTML, potentially compromising any user visiting a malicious page. This is the seventh exploited Chrome zero-day this year.

CRITICALAdvisorySep 10, 2026

Action required

Push Chrome updates to all endpoints immediately. Monitor for suspicious child processes spawned from chrome.exe and analyze browser crash dumps for exploitation indicators.

Affected products

ChromeGoogleWebGLCastWebPackaging

CVE IDs

CVE-2026-87491

Linked articles

Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox

Source links

https://thehackernews.com/2026/09/chrome-v8-zero-day-exploited-in-wild.html