Chrome patch rollout targets high-severity zero-day reportedly exploited in attacks

A patch for an out-of-bounds write in V8

The report says Google patched CVE-2026-87491 as part of a broader security update. It describes the issue as an out-of-bounds write flaw in Chrome’s V8 JavaScript and WebAssembly engine and says Google was aware of an exploit in the wild. The report says updates were rolling out to stable desktop users on Windows, Mac, and Linux, while full availability could take days or weeks.

The update concerns CVE-2026-87491, a flaw for which Google said it was aware of an exploit in the wild.

A report says patched Chrome versions began rolling out for Windows, Mac, and Linux after Google identified an exploit for CVE-2026-87491 as existing in the wild.

Rollout begins before every user is updated

A patch rollout does not mean every user has received the fix. The report says distribution to stable desktop users could take days or weeks.