Before getting into the specifics, it helps to understand what makes this kind of vulnerability different from a regular software bug.
A "zero-day" is a security flaw that attackers find and exploit before the software maker has had a chance to fix it. The name comes from the fact that the developer has had zero days to respond. By the time a patch is released, real damage may already be happening somewhere.
In this case, Google confirmed in a security advisory that "an exploit for CVE-2026-87491 exists in the wild," meaning someone built a working attack tool using this flaw and used it. Google has not said who was targeted, how many people were affected, or who was behind the attacks.
The vulnerability sits inside a part of Chrome called V8, the component responsible for running JavaScript on every webpage you visit. JavaScript is the programming language that powers most of the interactive features on the modern internet, from buttons and forms to video players and live chats. V8 runs all of it, on every tab you open, on every website you visit.
The specific flaw is what security researchers call an out-of-bounds write. Think of it this way: imagine a program is given a box that holds exactly ten items. This bug lets an attacker force the program to keep placing items into that box even after it is full, pushing data into the digital space next to it. In a browser, that neighboring space holds other sensitive information and instructions. Corrupting it gives an attacker the ability to take control of what the browser is doing.
What makes this especially concerning is how simple it is to trigger. According to the National Vulnerability Database, an attacker just needs to get a target to visit a specially built webpage. That could come through a phishing link in an email, a malicious advertisement on a legitimate website, or a compromised page the victim had no reason to distrust.
A University Student Found the Flaw
The vulnerability was discovered by Jihyeon Jeong, a research intern at Seoul National University's Compsec Lab in South Korea, who reported it to Google on August 6. Google rewarded Jeong with a $2,500 bug bounty for the responsible disclosure and began working on a fix.
The patch arrived on September 8, roughly 33 days after it was reported. During that window, someone else was apparently already using the flaw in real attacks. Whether attackers found the bug on their own or learned about it another way is something Google has not publicly addressed.
The US Government Is Treating This Seriously Too
The Cybersecurity and Infrastructure Security Agency, the federal body responsible for protecting US government systems from cyber threats, added this vulnerability to its official list of Known Exploited Vulnerabilities on the same day Google released the fix.
That listing comes with a hard deadline: federal civilian agencies must apply the patch by September 23, 2026. While that mandate only formally applies to government networks, companies and organizations across the private sector regularly use CISA's list as a guide for their own patching priorities. When CISA flags something as actively exploited, most security teams pay attention regardless of their sector.
This Is the Second Chrome Attack in Less Than a Week
Just five days earlier, on September 3, Google fixed a different Chrome vulnerability that was also being exploited in active attacks. That flaw, tracked as CVE-2026-85046, was also inside V8. Two exploited vulnerabilities in the same component of the same browser, patched within five days of each other.
Across all of 2026, seven Chrome flaws have now been confirmed exploited in the wild and patched. Three of those seven were inside V8 specifically. For comparison, Google patched eight Chrome zero-days across the entire 12 months of 2025.
Why does V8 keep coming up? Because it is one of the most attractive targets available to an attacker. It processes code from every website a person visits, it is extremely complex under the hood, and the programming language it is built in does not have built-in protections against the kind of memory errors that lead to these vulnerabilities. For sophisticated attackers, finding a flaw in V8 is like finding a master key.
Monday's Update Fixed 230 Security Flaws Total
The zero-day was not the only problem addressed in Monday's release. Chrome 153 fixed 230 security vulnerabilities in total, five of which were rated critical. Four of the critical issues were in WebGL, the part of Chrome that handles 3D graphics in the browser. A fifth critical flaw was found in the Cast component, which handles streaming to devices like Chromecast.
Interestingly, one of the high-severity bugs in the same update was credited to OpenAI Codex Security, an AI-powered security tool, suggesting that artificial intelligence is increasingly being used to find browser vulnerabilities alongside human researchers.
Google said it internally identified 195 of the 230 total flaws through its own security tools before they could be found and exploited by outsiders.
How to Update Chrome Right Now
Google's update will reach most users automatically over the coming days or weeks, but given that this flaw is already being exploited, waiting for the automatic rollout is not the right call.
Here is how to force the update immediately:
1. Open Google Chrome
2. Click the three dots in the top right corner of the browser window
3. Select Help, then click About Google Chrome
4. Chrome will automatically check for and download any available update
5. Once it finishes, click Relaunch to complete the installation
The safe versions are 153.0.8010.36 or higher for Windows and Linux, and 153.0.8010.37 for Mac. If your browser already shows one of those numbers on the About Chrome screen, you are protected.
Google has not named who was behind the attacks exploiting this vulnerability. In past years, Chrome zero-days have been linked to commercial spyware makers and government-backed hacking groups. For now, the company says it is keeping details about the attacks restricted while the patch continues rolling out to users worldwide.
