CVE-2026-87491

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-87491 8.8

Google · Chromium V8 · Added 2026-09-09 · Published 2026-09-09

3-Day Required KEV Active Exploitation

Details

VulnerabilityGoogle Chromium V8 Out of Bounds Write Vulnerability

VendorGoogle

ProductChromium V8

Date added2026-09-09

Due date2026-09-23

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-787

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Descriptions

KEV: Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

NVD: Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-09-09 20:18 UTC

Searches6

Component defaultyes

Sources https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html
https://nvd.nist.gov/vuln/detail/cve-2026-87491
https://thehackernews.com/2026/09/chrome-v8-zero-day-exploited-in-wild.html
https://www.securityweek.com/chrome-153-patches-seventh-zero-day-of-2026/
https://www.rapid7.com/db/vulnerabilities/cve-2026-87491/

Hunting hypothesis agent

Hunt for browser crash reports or telemetry indicating V8 memory corruption, specifically targeting the out-of-bounds write fixed in Chrome 153.0.8010.36, which typically manifests after processing crafted HTML from untrusted sources.

Research details

ComponentV8 JavaScript engine (out-of-bounds write)

PreconditionsRemote attacker can exploit this by luring a user to visit a malicious HTML page; the target must be running a Chromium-based browser (Chrome, Edge, Opera, etc.) with a V8 engine version prior to 153.0.8010.36. agent

Deliverycrafted HTML page

Public PoCno

Advisoryhttps://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html

Exploit notesCVSS attack complexity: LOW | Actively exploited zero-day; public PoC not yet available.

SummaryCVE-2026-87491 is an out-of-bounds write in the V8 JavaScript engine of Google Chrome, patched in version 153.0.8010.36. The vulnerability is actively exploited in the wild as a zero-day, allowing remote code execution inside the sandbox via crafted HTML pages. No public proof-of-concept exploit has been identified yet, but the vendor has confirmed active exploitation.

Tia coverage

First reported2026-09-04

First exploit report2026-09-09

Exploit report → KEV0 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

chrome-now-to-protect-against-an-actively-exploited-vulnerabilit cisa-kev-update-september-9-2026 google-fixes-actively-exploited-android-zero-day-on-pixel-device google-security-advisory-av26-904 proofpoint-identified-bluemoon-an-exploit-kit-chaining-two-chrom

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.