CVE-2026-3909

Google has patched a new Chrome zero-day vulnerability, CVE-2026-87491, which has been actively exploited in the wild. The vulnerability is a high-severity out-of-bounds write issue in the V8 JavaScript and WebAssembly engine, allowing remote attackers to execute arbitrary code within the browser sandbox by luring users to malicious HTML pages. Exploitation can lead to heap corruption, data exposure, or browser crashes. Google has not disclosed further details about the ongoing attacks to avoid exposing technical details before most users are patched.

A zero-day vulnerability in Chrome's V8 JavaScript and WebAssembly engine, tracked as CVE-2026-87491, is being actively exploited in the wild. The flaw is an out-of-bounds write that allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. Google has patched the vulnerability in Chrome versions 153.0.8010.36 and later, but has not disclosed specific details about the exploitation or the threat actor involved, likely to prevent further abuse before widespread patching.

Google has patched a high-severity zero-day vulnerability in Chrome's V8 JavaScript and WebAssembly engine, identified as CVE-2026-85046, which is being actively exploited in the wild. The flaw is a type confusion issue that could allow remote code execution if a user visits a specially crafted webpage containing malicious JavaScript. Google has not disclosed specific exploitation details to allow time for users to update. Chrome users are urged to update to version 152.0.7977.82 or later to mitigate the risk. This is the sixth actively exploited Chrome zero-day fixed by Google in 2026.