India, Sept. 9 -- Chrome users have another zero-day problem on their hands. Google has patched CVE-2026-87491, a vulnerability in the V8 JavaScript and WebAssembly engine that attackers are already exploiting in the wild.

The bug can let a malicious web page land attacker-controlled code inside Chrome's sandbox. That is serious, but there is an important line not to cross: Google has not disclosed a sandbox breakout or a full operating-system compromise linked to this flaw.

CVE-2026-87491 is an out-of-bounds write in V8. In simple terms, the browser can be tricked into writing data outside the memory area where it is supposed to go. Memory bugs like this can give attackers a way to interfere with how software behaves and, in some cases...