Exploitation observed; activity peaked at 3 mentions and remains active
Immediate actions
Patch google chrome systems immediately
Assume compromise if assets are exposed
Recommended action window: Immediate (within 24h)
NVD description
Use after free in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
reported a chrome fullchain (web -> shell) on pixel 10 to google. got a 9.6 cve (cve-2026-87464) and a fix in chrome.
now they bend the rules and refuse to pay the fullchain bonus bc one of the vulns in the chain was an unpatched nday. total payout: $2.5k. despite cve + shell :| https://t.co/wYXwMLStpM
Post summary
The post reports a Chrome fullchain on Pixel 10 resulting in CVE-2026-87464 and a Chrome fix, while complaining that Google denied a fullchain bonus because one vulnerability was an unpatched nday.
If you're using Google Chrome, check for updates.
CVE-2026-87464 is a critical WebGL use-after-free vulnerability that can potentially lead to arbitrary code execution.
Chrome 153.0.8010.36 includes the fix.
Open Chrome settings and make sure you're running a patched version.
Post summary
The post warns of CVE‑2026‑87464, a critical WebGL use‑after‑free flaw, and directs users to update to Chrome 153.0.8010.36 to apply the patch.
Google on Thursday released updates to patch 230 security vulnerabilities, including one that has come under active exploitation in the wild.
The medium-severity vulnerability, assigned the CVE identifier CVE-2026-87491 (CVSS score: N/A), has been described as an out-of-bounds bug in V8, Chrome's JavaScript and WebAssembly engine.
"Out-of-bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page," reads a description of the flaw on the NIST National Vulnerability Database (NVD).
Security researcher Jihyeon Jeong of Compsec Lab, Seoul National University, has been acknowledged for discovering and reporting the flaw on August 6, 2026. The researcher received a $2,500 bug bounty reward for responsible disclosure.
Cybersecurity
Google acknowledged it is "aware that an exploit for CVE-2026-87491 exists in the wild," but has not disclosed any additional specific information related to how it's being weaponized in real-world attacks and who is behind them.
"Access to bug details and links may be kept restricted until a majority of users are updated with a fix," the tech giant added. "We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed."
With the latest development, Google has addressed a total of seven actively exploited Chrome zero-days since the start of the year. This includes CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, and CVE-2026-85046.
Besides CVE-2026-87491, the latest update also fixes five critical security flaws in WebGL and Cast components -
CVE-2026-87464 - Use-after-free in WebGL
CVE-2026-87488 - Use-after-free in WebGL
CVE-2026-87438 - Out-of-bounds write in WebGL
CVE-2026-87527 - Buffer overflow in WebGL
CVE-2026-87628 - Use-after-free in Cast
Google said it reported 195 out of the 230 flaws that have been addressed in the update. One high use-after-free flaw in WebPackaging (CVE-2026-87639) is credited to OpenAI Codex Security.
Post summary
Google has released a patch for CVE-2026-87491 and confirms the vulnerability is actively exploited in the wild, with no PoC or exploit details disclosed.
The CVE record for CVE-2026-87464 details the vulnerability technically and notes a vendor patch, with no PoC, exploit, or active exploitation reported.
CVE-2026-87491, an out-of-bounds write in V8, was exploited in the wild for remote code execution inside the Chrome sandbox. Google shipped the fix in 153.0.8010.36. The same update closed 229 additional issues, including CVE-2026-87464, CVE-2026-87488, CVE-2026-87438, CVE-2026-87527 in WebGL, CVE-2026-87628 in Cast, and CVE-2026-87639 in WebPackaging.
Jihyeon Jeong of Compsec Lab, Seoul National University, reported the flaw on August 6, 2026 and collected the $2,500 bounty. Google credited 195 of the total fixes to internal teams.
This is the seventh Chrome zero-day exploited in 2026. Earlier cases were CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, and CVE-2026-85046.
Check chrome://version and confirm the build is at least 153.0.8010.36.
Post summary
CVE-2026-87491 was actively exploited in the wild for remote code execution in Chrome's sandbox, and Google has released a patch in version 153.0.8010.36 to address the out‑of‑bounds write in V8.
