Google warns of new Chrome zero-day bug exploited in attacks

Google released security updates addressing 230 vulnerabilities, including an actively exploited high-severity Chrome zero-day (CVE-2026-87491) — an out-of-bounds write in the V8 JavaScript/WebAssembly engine that can enable arbitrary code execution and heap corruption via crafted web pages; patched Stable Desktop versions for Windows, macOS, and Linux have been rolled out while Google restricts full disclosure until most users are updated. The report also lists several other zero-days patched earlier in the year and notes the updates may take days or weeks to reach all users.