CVE-2026-87438Active Exploitation(google / android)

Google on Thursday released updates to patch 230 security vulnerabilities, including one that has come under active exploitation in the wild. The medium-severity vulnerability, assigned the CVE identifier CVE-2026-87491 (CVSS score: N/A), has been described as an out-of-bounds bug in V8, Chrome's JavaScript and WebAssembly engine. "Out-of-bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page," reads a description of the flaw on the NIST National Vulnerability Database (NVD). Security researcher Jihyeon Jeong of Compsec Lab, Seoul National University, has been acknowledged for discovering and reporting the flaw on August 6, 2026. The researcher received a $2,500 bug bounty reward for responsible disclosure. Cybersecurity Google acknowledged it is "aware that an exploit for CVE-2026-87491 exists in the wild," but has not disclosed any additional specific information related to how it's being weaponized in real-world attacks and who is behind them. "Access to bug details and links may be kept restricted until a majority of users are updated with a fix," the tech giant added. "We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed." With the latest development, Google has addressed a total of seven actively exploited Chrome zero-days since the start of the year. This includes CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, and CVE-2026-85046. Besides CVE-2026-87491, the latest update also fixes five critical security flaws in WebGL and Cast components - CVE-2026-87464 - Use-after-free in WebGL CVE-2026-87488 - Use-after-free in WebGL CVE-2026-87438 - Out-of-bounds write in WebGL CVE-2026-87527 - Buffer overflow in WebGL CVE-2026-87628 - Use-after-free in Cast Google said it reported 195 out of the 230 flaws that have been addressed in the update. One high use-after-free flaw in WebPackaging (CVE-2026-87639) is credited to OpenAI Codex Security.

#securityupdate #chrome Google が，Chrome 153.0.8010.36 (Linux) および 153.0.8010.36/.37 (Windows/Mac) をリリース． CVE ベースで Critical 5 件 ・CVE-2026-87438 ・CVE-2026-87464 ・CVE-2026-87488 ・CVE-2026-87527 ・CVE-2026-87628 High 41 件を含む全 230… https://x.com/kawn2020/status/2097520500624990518

CVE-2026-87491, an out-of-bounds write in V8, was exploited in the wild for remote code execution inside the Chrome sandbox. Google shipped the fix in 153.0.8010.36. The same update closed 229 additional issues, including CVE-2026-87464, CVE-2026-87488, CVE-2026-87438, CVE-2026-87527 in WebGL, CVE-2026-87628 in Cast, and CVE-2026-87639 in WebPackaging. Jihyeon Jeong of Compsec Lab, Seoul National University, reported the flaw on August 6, 2026 and collected the $2,500 bounty. Google credited 195 of the total fixes to internal teams. This is the seventh Chrome zero-day exploited in 2026. Earlier cases were CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, and CVE-2026-85046. Check chrome://version and confirm the build is at least 153.0.8010.36.