Google has patched a critical security vulnerability in Chrome, the world’s most widely used browser, that was found to be actively exploited. The flaw, tracked as CVE-2026-87491, allows attackers to execute code on a target device via a specially crafted web page.
What exactly is the danger?
The vulnerability stems from an out-of-bounds write flaw in V8, Chrome’s JavaScript engine. Because such flaws allow an attacker to write to a memory region that does not belong to the browser itself, they often result in remote code execution.
Who is at risk?
The flaw can affect not only Chrome but also other Chromium-based browsers that use the same engine, such as Microsoft Edge and Opera. All Chrome installations older than version 153.0.8010.36 are considered at risk.
Why should you act quickly?
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its Known Exploited Vulnerabilities (KEV) catalog. This list includes only flaws that are actually exploited by attackers in the real world; this instance has also been linked to ransomware campaigns. CISA requires organizations to patch the flaw by September 23, 2026.
What should you do?
Updating Chrome to the latest version is enough. To do this, you can follow Help → About Google Chrome from the three-dot menu in the top-right corner of the browser; the browser will automatically check for and install the update. Edge and Opera users are also advised to keep their browsers up to date.
Source: CISA Known Exploited Vulnerabilities (KEV) Catalog · NVD
Share your experience
Got a question, a different solution or a note to add?
Log in or join us to write a comment.
Log in ↗︎Sign up ↗︎