Google Chromium V8 Vulnerability: Critical Out-of-Bounds Write
- Severity
- HIGH
- Affected component
- chromium v8 (npm)
- Patched version
- Not yet available
An out-of-bounds write vulnerability in Google Chromium V8 has been reported, which could allow remote attackers to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability may affect multiple web browsers that utilize Chromium, including Google Chrome, Microsoft Edge, and Opera.
What happened
An out-of-bounds write vulnerability in Google Chromium V8, identified as CVE-2026-87491, has been reported to be exploited in the wild. This vulnerability allows a remote attacker to execute arbitrary code inside the sandbox via a specially crafted HTML page. The vulnerability affects multiple web browsers that utilize Chromium, including Google Chrome, Microsoft Edge, and Opera. Security researcher Jihyeon Jeong of Compsec Lab, Seoul National University, discovered and reported the flaw on August 6, 2026, and received a $2,500 bug bounty reward for responsible disclosure.
Google has acknowledged the existence of an exploit for CVE-2026-87491 in the wild but has not disclosed specific details about the attacks or the attackers. The company has released updates to address the vulnerability, but the exact version range affected has not been published. Users are advised to monitor for patches and upgrade Chromium V8 to the latest version once available.
What to do about it
- Monitor for patches and upgrade Chromium V8 to the latest version once available.
- Stay informed by consulting primary sources for updates on the vulnerability and any patches released.
- Implement additional security measures to mitigate the risk of remote code execution, such as enabling browser sandboxing and using up-to-date antivirus software.
How 0Day would have caught this
chromium v8 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using web browsers that utilize Chromium, including Google Chrome, Microsoft Edge, and Opera, you may be affected by this vulnerability.
What should I do right now?
Monitor for patches and upgrade Chromium V8 to the latest version once available. Stay informed by consulting primary sources for updates on the vulnerability and any patches released.
Has this been exploited in the wild?
Yes, the vulnerability has been reported to be exploited in the wild.