Google Chrome: CVE-2026-87491 V8 Zero-Day Enables Arbitrary Code Execution

Google has patched CVE-2026-87491, a critical out-of-bounds (OOB) write vulnerability in the V8 JavaScript and WebAssembly engine, following reports of active exploitation in the wild. Threat actors are leveraging this zero-day to achieve arbitrary code execution (ACE) via malicious web content or specifically crafted WebAssembly payloads. Intelligence indicates Chinese-linked APTs are integrating this flaw into multi-stage exploit chains designed to bypass Windows security controls and facilitate full system compromise. Immediate remediation is required by updating Google Chrome to version 153.0.8010.36/37 across Windows, macOS, and Linux to mitigate the risk of remote exploitation and subsequent host-level persistence.

• Vulnerability Mechanics: V8 Engine Memory Corruption

  • CVE-2026-87491 is identified as an out-of-bounds (OOB) write vulnerability within the V8 JavaScript and WebAssembly engine.
  • Attackers manipulate memory through specifically crafted JavaScript objects or malicious WebAssembly modules to trigger corruption.
  • Patch diffing analysis between Chrome 152 and 153 indicates the flaw stems from improper bounds checking during memory operations.

• Exploitation Vector: Remote ACE and Sandbox Escalation

  • Exploitation is delivered via remote, malicious web content, requiring no user interaction beyond visiting a compromised website.
  • Successful exploitation results in arbitrary code execution (ACE) within the browser's restricted process context.
  • This vulnerability serves as a critical initial entry point for subsequent sandbox escapes and local privilege escalation (LPE) attempts.

• Threat Intelligence: State-Sponsored Exploitation Chains

  • Intelligence reports confirm that multiple Chinese-linked threat actors are actively utilizing this zero-day in the wild.
  • Adversaries are integrating the V8 flaw into sophisticated, multi-stage exploit chains to bypass Windows security mechanisms.
  • These campaigns are highly targeted, focusing on achieving deep host-level persistence and facilitating lateral movement within target networks.

• Remediation: Emergency Patch Orchestration

  • Google has issued an emergency update (Chrome version 153) that addresses this flaw alongside 229 other security vulnerabilities.
  • Mandatory updates include version 153.0.8010.36/37 for Windows and macOS, and 153.0.8010.36 for Linux.
  • Security teams must prioritize browser fleet management to close the active "patch gap" currently being exploited by APT actors.