Chrome Fixes 230 Flaws; 7th Zero-Day Exploited

Google's browser security team moved quickly this week to address a new actively exploited vulnerability in Chrome, a bug that lets remote attackers run code inside the browser's sandbox. The patch arrives as part of a massive security update that addresses 230 vulnerabilities in total, a number that underscores the sheer volume of flaws being found and fixed in one of the world's most widely used pieces of software.

The vulnerability, tracked as CVE-2026-87491, is described as an out-of-bounds write in V8, Chrome's JavaScript and WebAssembly engine. A crafted HTML page could trigger the flaw, allowing an attacker to execute arbitrary code within the sandbox environment the browser normally enforces. Google has acknowledged that an exploit for this vulnerability is being used in real-world attacks, though the company has not yet shared specific details about the attack chains or the actors behind them.

Out-of-Bounds Write in V8

V8, the engine that compiles and executes JavaScript, has historically been a prime target for attackers. In this case, the vulnerability is an out-of-bounds write, a memory corruption issue that can occur when a program writes data past the end of an allocated buffer. Such a flaw can be leveraged to corrupt memory in ways that could allow an attacker to take control of an application's execution flow.

The National Institute of Standards and Technology (NIST) posted a brief description of the flaw, noting that it affects Google Chrome versions prior to 153.0.8010.36. The medium-severity issue can be triggered remotely via a malicious web page, and it carries a CVSS score that was not available at the time of publication.

Jihyeon Jeong, a security researcher from Compsec Lab at Seoul National University, is credited with finding and reporting the bug on August 6, 2026. For responsibly disclosing the vulnerability, Jeong received a $2,500 bug bounty reward.

Seven Exploited Zero-Days This Year

With the inclusion of CVE-2026-87491, Google has now addressed a total of seven actively exploited Chrome zero-days since the start of the year. This count includes a series of previously disclosed vulnerabilities, which have been cataloged in security advisories and news reports throughout 2026.

• Total vulnerabilities patched in this update: 230
• Actively exploited zero-days addressed in 2026: 7
• Flaws reported by Google itself: 195

The other zero-day vulnerabilities patched earlier this year include CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, and CVE-2026-85046. Each of these was exploited in the wild, making them significant threats to Chrome users worldwide.

Additional Critical Flaws Patched

Beyond the zero-day, the latest Chrome update also fixes five other critical vulnerabilities. These include several use-after-free issues and other memory corruption flaws in WebGL and Cast components. The specific CVEs and their descriptions are as follows:

• CVE-2026-87464: Use-after-free in WebGL
• CVE-2026-87488: Use-after-free in WebGL
• CVE-2026-87438: Out-of-bounds write in WebGL
• CVE-2026-87527: Buffer overflow in WebGL
• CVE-2026-87628: Use-after-free in Cast

According to Google, the company itself reported 195 of the 230 flaws fixed in this update. One high-severity use-after-free vulnerability in WebPackaging, tracked as CVE-2026-87639, is credited to OpenAI Codex Security, an AI-powered security tool.

How the Flaws Were Found

Google's security team employs a variety of techniques to uncover vulnerabilities in Chrome. The company noted that many of its security bugs are detected using a suite of sanitizer and fuzzing tools, including AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL. These tools automatically identify memory corruption and other issues by instrumenting the code and feeding it malformed input.

This approach has proven effective in catching flaws before they can be exploited, though the fact that some zero-days still slip through suggests that attackers are often finding bugs that the internal testing misses. The exact number of flaws found by these tools in this update was not disclosed, but the sheer volume of vulnerabilities patched indicates that fuzzing remains a critical part of Chrome's security lifecycle.

Updates and Mitigation

Google has a standard procedure for addressing security flaws in Chrome, which involves releasing a stable channel update. In this case, the update brings the browser to version 153.0.8010.36/.37 for Windows and Apple macOS, and version 153.0.8010.36 for Linux. Users are strongly advised to update their browsers as soon as possible to protect against the actively exploited zero-day.

To ensure the latest updates are installed, users can navigate to More > Help > About Google Chrome and select Relaunch. This will trigger a check for updates and download any available patches.

Google's approach to vulnerability disclosure is cautious, especially when it comes to exploits in the wild. The company notes: "Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed." This policy aims to prevent attackers from learning the details of the vulnerability before a large number of users have applied the fix.

Chromium Browsers Affected

Because Chrome is based on the open-source Chromium project, many other browsers share the same underlying code. As a result, users of these browsers may also be affected by the same vulnerabilities. Google recommends that users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi apply the fixes as soon as they become available, as these browsers will need to release their own updates to address the flaws.

The specific versions and timing of updates for these browsers have not been announced, but users should watch for updates from their respective browser vendors. The active exploitation of CVE-2026-87491 makes it particularly important for users to stay vigilant and apply updates promptly.

Why It Matters

The active exploitation of this zero-day is a reminder of the constant pressure that browser vendors face to stay ahead of attackers. With this being the seventh actively exploited zero-day in Chrome this year, it suggests that attackers are finding and using these vulnerabilities more frequently than ever before. For users, this means that keeping the browser up to date is not just a matter of convenience, but a critical security practice. The fact that the vulnerability allows code execution within the sandbox is particularly concerning, as the sandbox is a key line of defense against malware. If attackers can bypass it, they may be able to compromise the entire system. This could have serious implications for businesses and individuals who rely on Chrome for daily activities, emphasizing the need for timely updates and robust security practices.