{"id":2756,"date":"2026-09-09T09:28:45","date_gmt":"2026-09-09T09:28:45","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2756"},"modified":"2026-09-09T09:28:45","modified_gmt":"2026-09-09T09:28:45","slug":"chrome-v8-zero-day-exploited-in-the-wild-enables-code-execution-inside-sandbox","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2756","title":{"rendered":"Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Sep 09, 2026<\/span><\/span>Vulnerability \/ Browser Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Google on Thursday released<\/a> updates to patch 230 security vulnerabilities, including one that has come under active exploitation in the wild.<\/p>\n

The medium-severity vulnerability, assigned the CVE identifier CVE-2026-87491<\/strong> (CVSS score: N\/A), has been described as an out-of-bounds bug in V8, Chrome’s JavaScript and WebAssembly engine.<\/p>\n

\u00abOut-of-bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page,\u00bb reads a description<\/a> of the flaw on the NIST National Vulnerability Database (NVD).<\/p>\n

Security researcher Jihyeon Jeong of Compsec Lab, Seoul National University, has been acknowledged for discovering and reporting the flaw on August 6, 2026. The researcher received a $2,500 bug bounty reward for responsible disclosure.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Google acknowledged it is \u00abaware that an exploit for CVE-2026-87491 exists in the wild,\u00bb but has not disclosed any additional specific information related to how it’s being weaponized in real-world attacks and who is behind them. <\/p>\n

\u00abAccess to bug details and links may be kept restricted until a majority of users are updated with a fix,\u00bb the tech giant added. \u00abWe will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven\u2019t yet fixed.\u00bb<\/p>\n

With the latest development, Google has addressed a total of seven actively exploited Chrome zero-days since the start of the year. This includes CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, and CVE-2026-85046.<\/p>\n

Besides CVE-2026-87491, the latest update also fixes five critical security flaws in WebGL and Cast components – <\/p>\n