URGENT: Active Google Chrome V8 Zero-Day (CVE-2026-87491)

Hackers are actively exploiting a critical zero-day vulnerability in Google Chrome. If you manage enterprise workstations or monitor corporate security logs, everything else needs to take a back seat today. Google has just rolled out an emergency security update to patch a high-severity vulnerability tracked as CVE-2026-87491. This isn't a theoretical bug discovered in a lab. Threat actors are actively using this Chromium zero-day exploit in the wild right now to target enterprise environments. At the core of this issue is a critical vulnerability in the V8 engine. That's the high-performance JavaScript and WebAssembly engine powering Google Chrome and several other enterprise browsers. When attackers target this V8 remote code execution flaw, all it takes is tricking a user into loading a single malicious web page. By triggering memory corruption inside the engine, an attacker can execute arbitrary code remotely. That lets them break out of workstation boundaries and establish a foothold for lateral movement across your internal network. Here are the three actionable steps you need to take right now to protect your organization. First, understand your full exposure across the Chromium ecosystem. Because the vulnerability exists directly within the V8 engine, CVE-2026-87491 isn't limited only to Chrome. Workstations running other browsers such as Microsoft Edge and Brave are also vulnerable until their respective upstream patches are deployed. Audit your fleet immediately to catalog every Chromium-based application installed across your endpoints. Second, verify version status across all endpoints using centralized telemetry. Don't rely on end users to manually open their browser settings, click Help, and check the About page—and let's be honest, almost nobody does that. Pull a live inventory from your endpoint detection and response platform or mobile device management console right now. Filter for outdated browser binaries, and isolate any workstations that haven't received the CVE-2026-87491 patch. Third, enforce browser restarts to complete the mitigation fleet-wide. Here's the most dangerous gap in browser patching: Chrome often downloads updates silently in the background, but the new patch never takes effect until the process fully restarts. In an enterprise environment where employees keep sessions open for weeks, an un-restarted browser remains fully exploitable. Push a forced restart policy through your MDM or group policy tools to guarantee that every active process swaps to the secure build. Don't wait for your standard weekly maintenance window. Check your fleet status, push the update, and enforce restarts immediately. Share this briefing with your IT operations and security engineering teams, and stay tuned for ongoing real-time analysis of active exploits and enterprise threat mitigation.