Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox
- ID
- 22684
- Status
- summarized
- Published
- 09 Sep 2026, 5:11 PM
- Fetched
- 10 Sep 2026, 2:52 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/09/chrome-v8-zero-day-exploited-in-wild.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 6.5
- Created
- 10 Sep 2026, 2:53 PM
- Tags
- Audience
- developersvibe_codersai_ml_learners
What happened
Google patched 230 Chrome vulnerabilities including CVE-2026-87491, an actively exploited out-of-bounds write in the V8 engine allowing arbitrary code execution inside the sandbox via a crafted HTML page, fixed in Chrome 153.0.8010.36. This is the seventh actively exploited Chrome zero-day patched in 2026. Notably, one of the other patched bugs (CVE-2026-87639, a use-after-free in WebPackaging) was credited to OpenAI Codex Security, suggesting AI-assisted vulnerability discovery.
Why it matters
Update Chrome to 153.0.8010.36 or later immediately on all development and testing machines — the exploit is in the wild and requires only a crafted HTML page. If you ship Electron-based apps or use Puppeteer/Playwright with bundled Chromium, check whether your version is affected and update the embedded runtime. The OpenAI Codex Security credit on a separate bug is a concrete signal that AI coding tools are now finding real browser-engine vulnerabilities, worth noting for anyone evaluating AI-assisted security tooling.
Discussion angle
The OpenAI Codex Security credit on CVE-2026-87639 — is AI-assisted vulnerability discovery becoming a practical tool for security teams, and what does that mean for builders who now ship code faster with AI but may also need AI to find the bugs they introduce?