Attackers are exploiting a medium-rated V8 write in Chrome's 230-fix release

V8 runs the JavaScript on every page Chrome renders. An out-of-bounds write there lets a crafted HTML page push the engine into mishandling memory and executing attacker-chosen instructions inside the browser's sandbox ^[7]. There is no download step and no credential step involved. Malwarebytes notes that reputable mail clients strip active content from incoming HTML, so the message body will not fire this; a link in that message to an attacker-controlled page will ^[13].

The rating is the part worth arguing with. Malwarebytes puts CVE-2026-87491 at medium severity ^[1], while the same release closes five flaws rated critical, four of them in WebGL ^[5], which puts 80 percent of the critical-rated bugs in one graphics component ^[11]. Sort the release by severity and the WebGL bugs go first. Sort it instead by who is already using what, and the medium bug moves to the top, because it is the only one in the batch with reported exploitation behind it ^[15]. The sandbox is why the number is low: the code lands inside Chrome's sandbox rather than on the host ^[8]. That is a foothold, and a foothold needs a second bug to reach the device.

The 230 figure is a scheduling number rather than a risk number ^[3]. Severity is stated for six of those fixes, leaving 224 unranked in this account ^[14]. In practice, nobody triages 230 items here; the thing that actually gets triaged is one restart.

That restart is where deferral lives. Chrome updates itself, but the update completes only when the browser is restarted, and a session that is never closed, or one where an extension breaks the update, sits on the old build indefinitely ^[9]. The manual path is the More menu, then Settings, then About Chrome, then a restart ^[10]. On Windows and Mac the target build is 153.0.8010.36 or .37, and on Linux it is 153.0.8010.36 ^[2]. The remediation cost per endpoint is one browser restart, so lag on this release is a decision about session uptime somebody owns, not a gap in patch management.

What is established is the mechanism; the actor, a date for first exploitation, and whether the V8 write was chained to a sandbox escape in the wild are not established in this material ^[12]. The mechanism is what the evidence supports. The browser is the reachable entry point in this release, and the campaign context around CVE-2026-87491 is not established by an advisory summary.