Google Just Patched 230 Holes, But One Is Already Being Used

Emily Davis · 2026-09-09

Google dropped a massive security update on Thursday, patching 230 vulnerabilities across Chrome. That's a big number, sure. But here's what actually matters: one of those bugs is already being exploited in the wild right now. The culprit? A bug in V8, Chrome's JavaScript and WebAssembly engine. If you're wondering why that name keeps popping up in security news, it's because V8 is the engine that runs just about everything you do in a browser tab. When something goes wrong there, it goes wrong in a big way. ### What Is CVE-2026-87491, Exactly? The vulnerability is tracked as CVE-2026-87491. It's been classified as medium severity, which might make you want to shrug it off. Don't. Here's the thing about severity scores. They measure technical impact, not real-world danger. A bug that's actively being exploited is a different beast entirely. Attackers aren't waiting for a perfect 10 out of 10. They're using what works. This particular flaw is an out-of-bounds write in V8. In plain English? The browser's memory handling gets confused and lets data spill into places it shouldn't. That spill can be weaponized to run malicious code inside the sandbox, the very layer meant to keep harmful activity contained. Think of it like a locked room where someone figured out how to slide a note under the door. The room is still locked, but the note is now inside. And that note can tell the room what to do. ### Why the Sandbox Isn't a Magic Shield A lot of people hear "sandbox" and assume they're safe no matter what. That assumption is exactly what attackers count on. The sandbox is designed to limit damage, not eliminate it. It's a fence, not a fortress. When a bug like this one lets code slip past the fence, the whole security model starts to wobble. What makes this worse is that Chrome is the most popular browser on the planet. That's a huge target. When a working exploit exists for a widely used browser, the clock starts ticking for everyone who hasn't updated yet. And updates don't always roll out instantly. Some people delay them. Some devices are managed by IT teams that schedule patches weeks out. That gap is where real damage happens. ### What You Should Actually Do You don't need to panic, but you do need to move. Here's the short list: - Update Chrome right now. Not tonight. Not tomorrow. Now. The fix is already out. - Restart your browser fully. A pending update doesn't protect you until it's applied. - Update Chrome on every device you use, including phones and tablets. - If you manage a team, push the update through your device management tools immediately. - Be cautious with unfamiliar links, even after updating. Exploits often arrive through phishing or sketchy ads. "The gap between a patch being released and a patch being installed is where attackers live." That's not a scare tactic. It's just how the math works. ### The Bigger Picture This isn't the first V8 bug to cause headaches, and it won't be the last. V8 is complex, and complexity always leaves room for mistakes. Google patches them fast, but fast isn't instant. What you control is your response time. The people who get hurt by these exploits are rarely the ones who updated on day one. They're the ones who meant to update and forgot. So set a reminder. Check your version. Restart the browser. It takes two minutes, and it's the difference between being protected and being a statistic. Security isn't about being paranoid. It's about being quick when it counts. And right now, it counts.