Keyword

browser

2 dispatches · latest 10 SEP 2026 · all keywords →

10 SEP 2026exploits

A 'Medium' Severity Zero-Day That Someone Is Actually Exploiting: Chrome V8's CVE-2026-87491

Five days after our last Chrome zero-day post, Google patched a second exploited V8 bug — rated Medium by the vendor with no vector of its own, and CISA added it to KEV the next day. Browser patching is a cadence problem now.

High severity, 3 of 4. Patch at your next window. Real impact, real exposure.CVSS 8.8Exploited in the wildKEV due 23 SEP 2026CVE-2026-87491 +6

chrome v8 zero-day

05 SEP 2026exploits

Chrome's array.sort() Hides a Zero-Day That's Already in the Wild: CVE-2026-85046 Lands on KEV

A type-confusion bug in V8's Maglev compiler turns an ordinary sort() into arbitrary read/write on the JS heap. Fixed in 152.0.7977.82, actively exploited, and it's the sixth of these this year.

High severity, 3 of 4. Patch at your next window. Real impact, real exposure.CVSS 8.8Exploited in the wildKEV due 18 SEP 2026CVE-2026-85046 +5

chrome v8 zero-day