In short: Google patched the seventh actively exploited Chrome zero-day of 2026 — CVE-2026-87491, an out-of-bounds write in the V8 JavaScript engine. The vulnerability allows arbitrary code execution through a malicious webpage. The fix is available in Chrome 153.0.8010.36 and later: update now without waiting for the automatic cycle.
What happened
On September 9, 2026, Google released an out-of-band Chrome 153 update, patching 230 vulnerabilities including one actively exploited zero-day. The flaw resides in V8 — Chrome's JavaScript and WebAssembly engine, which processes all script code on every page you open. It was discovered by Jihyeon Chon, an intern at Seoul National University's Compsec laboratory, who responsibly disclosed it to Google's security team.
CVE-2026-87491 is the seventh Chrome zero-day exploited in real attacks in 2026. By comparison, only three such vulnerabilities were confirmed in all of 2024. The trend reflects the browser's evolution into the primary gateway to digital life: banking, messaging apps, work tools, and personal data all flow through it.
How the vulnerability works
CVE-2026-87491 is an out-of-bounds write flaw: software writes data beyond the boundary of an allocated memory buffer. In V8, this allows an attacker to corrupt adjacent memory structures, hijack the execution flow, and ultimately run arbitrary machine code inside the browser process.
The attack vector is a specially crafted HTML page. An attacker simply needs the victim to open a malicious link — delivered through a phishing email, malicious advertising on a legitimate site (malvertising), or a compromised website. No further user interaction is required: the page loads and the code runs.
Google temporarily withheld technical details of CVE-2026-87491 to allow as many users as possible to update before attackers could reproduce the exploit from public documentation. This means real attacks were underway before the patch was even published.
Who is at risk
Chrome holds approximately 65% of the global browser market. The vast majority of internet users are potentially vulnerable until they receive version 153.
Highest risk groups include:
- Users whose work browser has access to corporate systems;
- Anyone who opens unfamiliar links from email, messaging apps, or social media;
- Devices with Chrome auto-updates disabled through corporate Group Policy or custom builds.
Why VPN doesn't protect against browser zero-days
It's important to understand the difference between network-layer threats and application-layer threats. LiMP VPN encrypts traffic between your device and the server: an attacker on a public Wi-Fi network cannot intercept your data or tamper with server responses. This protects against MITM attacks, ISP surveillance, and DNS query leakage.
CVE-2026-87491 operates differently: the attack occurs inside the browser during JavaScript processing. Malicious code runs in your device's memory without ever touching the network stack that the VPN client controls. Any data exfiltration or malware download happens before traffic leaves the device at all.
The takeaway: browser zero-days and network threats are solved at different layers, and comprehensive protection requires both:
- Network layer — VPN encrypts connections, hides your IP, and secures DNS;
- Browser layer — keeping Chrome updated closes zero-days like this one;
- Device layer — antivirus software detects post-exploitation activity.
How to update Chrome right now
Updating takes less than a minute:
- Open Chrome and click the menu icon (three dots) in the top-right corner.
- Select Help → About Google Chrome.
- Chrome will automatically check for and download any available updates.
- Click Relaunch to apply the update.
- Verify the browser version is 153.0.8010.36 (Windows/Linux) or 153.0.8010.37 (macOS) or higher.
On Android, update Chrome through Google Play. On iOS, through the App Store. If your organisation manages updates through Group Policy, contact your IT administrator — corporate configurations frequently delay patch rollout. For more on staying safe online, visit the LiMP VPN security blog.
Additionally, consider enabling Enhanced Protection in Chrome (Settings → Privacy and security → Safe Browsing → Enhanced protection). This mode checks visited URLs in real time and warns you about phishing pages before they load.
Sources
- Anti-Malware.ru: Update Chrome — hackers are already exploiting the new zero-day (September 9, 2026)
- BleepingComputer: Google patches seventh Chrome zero-day exploited in attacks this year
- The Hacker News: Chrome V8 Zero-Day CVE-2026-87491 Exploited in the Wild
- SecurityWeek: Chrome 153 Patches Seventh Zero-Day of 2026