Reported by 2 outlets
Google security advisory (AV26-904)
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 4.70 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.58 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Google security advisory (AV26-904)
malware.news · 34d ago · September 9th, 2026
Serial Number: AV26-904 Date: September 9, 2026 As of September 8, 2026, Google is affected by vulnerabilities in the following product: Chrome Prior to 153.0.8010.37 Google is aware that an exploit for CVE-2026-87491 exists in the wild. On September 9, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-87491 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Stable Channel Update for Desktop CISA KEV: CVE-2026-87491 Article Link: Google security advisory (AV26-904) - Canadian Centre for Cyber Security
-
update from socprime.com
CVE-2026-87491: Chrome V8 Zero-Day Exploited in the Wild Enables Arbitrary Code Execution
socprime.com · 34d ago · September 9th, 2026
Google has released Chrome 153 with a fix for another zero-day vulnerability already being exploited in real-world attacks. Tracked as CVE-2026-87491, the flaw is an out-of-bounds write vulnerability in V8, the JavaScript and WebAssembly engine at the core of Google Chrome. Successful exploitation can allow a remote attacker to execute arbitrary code inside the browser sandbox through a specially crafted HTML page. The vulnerability was fixed in Chrome 153.0.8010.36/.37 for Windows and macOS and 153.0.8010.36 for Linux as part of the September 8, 2026 Stable Channel release. Google confirmed that an exploit already exists in the wild but has not disclosed who is using it, which organizations have been targeted, or how the exploit is being delivered. Despite Google assigning the vulnerability a Medium Chromium security severity, its exploitation status significantly raises the operational risk. Memory corruption in V8 can provide attackers with code execution in a renderer process and may become part of a larger browser exploit chain when paired with another flaw capable of escaping Chrome’s sandbox. The new Chrome zero-day bug exploited in attacks is the seventh Chrome vulnerability patched by Google this year after being used as a zero-day, highlighting how browser engines remain a high-value target for sophisticated threat actors. Contact Sales CVE-2026-87491 analysis CVE-2026-87491 is categorized as CWE-787: Out-of-Bounds Write . This type of memory-safety weakness occurs