On Tuesday, **Google** rolled out an essential security update for **Chrome**, rectifying 230 vulnerabilities. Among these, a significant actively exploited zero-day bug, identified as **CVE-2026-87491**, stands out as the seventh such flaw addressed this year. "Google is aware that an exploit for **CVE-2026-87491** exists in the wild," the company stated in its security advisory. The patch is now being rolled out for Windows (version 153.0.8010.36), Mac (153.0.8010.37), and Linux (153.0.8010.36) systems in the Stable Desktop channel. This rapid response comes just two days after the vulnerability was reported to Google by Jihyeon Jeong, a research intern at **Seoul National University's Compsec Lab**. While Google notes that the update may take days or weeks to reach all users globally, it was immediately available for manual updates at the time of reporting.  ### Understanding CVE-2026-87491 **CVE-2026-87491** is a high-severity zero-day rooted in an out-of-bounds write weakness within **Chrome's V8 JavaScript and WebAssembly engine**. This vulnerability could allow remote attackers to execute arbitrary code within the browser's sandbox through specially crafted HTML pages. Successful exploitation could also lead to data access beyond the memory buffer via heap corruption, potentially exposing sensitive information or causing application crashes. ### Limited Disclosure on Exploitation Despite confirming active exploitation, Google has provided limited details regarding the nature of these attacks. The company typically restricts access to bug details and related links until a majority of users have updated their software. This policy also applies if the bug resides in a third-party library that other projects depend on but have not yet fixed.  ### A Troubling Trend: Seven Zero-Days in 2026 This latest patch highlights a concerning trend, bringing the total number of actively exploited **Chrome** zero-days addressed this year to seven. Previous zero-days patched in 2026 include: * **CVE-2026-2441**: An iterator invalidation bug in **CSSFontFeatureValuesMap**, addressed in mid-February. * **CVE-2026-3909**: An out-of-bounds write weakness in the **Skia 2D graphics library**, and **CVE-2026-3910**: an inappropriate implementation vulnerability in the **V8 JavaScript and WebAssembly engine**, both fixed in March. * **CVE-2026-5281**: A use-after-free weakness in **Dawn**, the cross-platform implementation of the WebGPU standard, patched in April. * **CVE-2026-85046**: A type confusion flaw in **V8**, fixed earlier this month. In 2025, Google also addressed eight other zero-days exploited in the wild, many of which were reported by its **Threat Analysis Group (TAG)**, known for tracking zero-day exploits used in spyware attacks. The continuous stream of critical vulnerabilities underscores the importance of prompt updates for all **Chrome** users.