Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox
CVE-2026-87491 is an actively exploited out-of-bounds write vulnerability in Google Chrome's V8 JavaScript/WebAssembly engine, enabling arbitrary code execution inside the sandbox via a crafted HTML page Google patched 230 security vulnerabilities in a single update, including five critical flaws in WebGL and one in Cast, marking the seventh actively exploited Chrome zero-day addressed since the start of 2026 The vulnerability was discovered and responsibly disclosed by researcher Jihyeon Jeong
Analysis
TL;DR
- CVE-2026-87491 is an actively exploited out-of-bounds write vulnerability in Google Chrome's V8 JavaScript/WebAssembly engine, enabling arbitrary code execution inside the sandbox via a crafted HTML page
- Google patched 230 security vulnerabilities in a single update, including five critical flaws in WebGL and one in Cast, marking the seventh actively exploited Chrome zero-day addressed since the start of 2026
- The vulnerability was discovered and responsibly disclosed by researcher Jihyeon Jeong of Compsec Lab, Seoul National University, who received a $2,500 bug bounty reward
- Google credited OpenAI Codex Security for discovering a high-severity use-after-free flaw in WebPackaging (CVE-2026-87639), highlighting the role of AI-assisted security research
- Chrome users are urged to update to versions 153.0.8010.36/.37 immediately, with the same guidance extending to all Chromium-based browsers including Edge, Brave, Opera, and Vivaldi
Why It Matters
This incident underscores the escalating frequency of actively exploited zero-day vulnerabilities in browser engines, with Google now addressing seven such flaws in 2026 alone — signaling a sustained and targeted campaign against Chrome's V8 and related components. The involvement of OpenAI Codex Security in bug discovery also highlights the growing impact of AI-assisted security research on vulnerability detection, which could reshape how organizations approach code auditing and defensive engineering.
Technical Details
- CVE-2026-87491: An out-of-bounds write vulnerability in V8 (Chrome's JavaScript and WebAssembly engine) that allows a remote attacker to execute arbitrary code inside the sandbox by luring a victim to a crafted HTML page. The bug was classified as medium severity with no published CVSS score.
- WebGL critical flaws: Five critical vulnerabilities were patched in WebGL — CVE-2026-87464 (use-after-free), CVE-2026-87488 (use-after-free), CVE-2026-87438 (out-of-bounds write), and CVE-2026-87527 (buffer overflow) — all of which could enable sandbox escape through malicious web content.
- Cast component flaw: CVE-2026-87628 is a use-after-free vulnerability in the Cast component, also rated critical, expanding the attack surface beyond the core rendering engine.
- WebPackaging flaw: CVE-2026-87639, a high-severity use-after-free in WebPackaging, was discovered by OpenAI Codex Security, demonstrating AI-driven vulnerability detection capabilities.
- Detection methodology: Google employs a suite of automated fuzzing and sanitization tools including AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL to identify security bugs in Chrome's codebase.
- Patch scope: Of the 230 vulnerabilities addressed, Google reported 195 internally; the remaining were discovered by external researchers and responsible disclosure programs.
Industry Insight
- The seven actively exploited Chrome zero-days in 2026 suggest coordinated threat actor interest in browser-based attack chains; organizations should prioritize rapid patch deployment cycles and consider endpoint detection rules targeting V8 exploitation patterns.
- The OpenAI Codex Security discovery of CVE-2026-87639 signals that AI-assisted code analysis is becoming a competitive advantage in vulnerability research — companies should evaluate integrating similar AI tools into their secure SDLC and bug bounty programs.
- The concentration of critical flaws in WebGL and Cast components indicates these less-audited subsystems represent high-value attack surfaces; security teams should advocate for hardened configurations (e.g., disabling Cast when unnecessary) and push for increased fuzzing coverage on peripheral browser modules.
Disclaimer: The above content is generated by AI and is for reference only.