Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox
Summary: Google released updates patching 230 security vulnerabilities, including CVE-2026-87491, an out-of-bounds write in Chrome's V8 engine (CVSS 8.8) that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Google said it is aware an exploit for the flaw exists in the wild, and CISA added it to the KEV catalog on September 9, 2026, with a September 23, 2026 patch deadline for FCEB agencies.
Why it matters: This is the seventh actively exploited Chrome zero-day Google has addressed since the start of the year, and the exploit is already in use against a bug that lives inside the browser sandbox - the boundary most teams treat as their last line of defense.