CVE-2026-87491 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: USER_INTERACTION

CVE Published: 2026-09-09

Added to CISA KEV: 2026-09-09 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
CRITICAL: This vulnerability is in CISA KEV indicating active exploitation in the wild. While it is a client-side (not server) risk, endpoints should be treated as potential entry points — review endpoint EDR telemetry, browser crash logs, and suspicious child processes spawned from Chrome.
Immediately update Google Chrome to version 153.0.8010.36 or later; ensure Chromium-based browsers (Edge, Opera, Brave) are also patched to versions incorporating the fixed V8 build.
Deploy enterprise browser management (e.g., Chrome auto-update policies) to enforce rapid patch rollout; consider enabling Enhanced Safe Browsing and site isolation.
Patch Priority: URGENT for all endpoints due to active zero-day exploitation, despite this NOT being a T1190 internet-facing server exposure. Monitor for drive-by/watering-hole delivery via web proxy and DNS logs.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-87491 is an out-of-bounds write vulnerability located within the V8 JavaScript and WebAssembly engine used by Google Chrome and other Chromium-based browsers. This vulnerability is significant because it has been actively exploited in the wild as a zero-day, allowing remote attackers to achieve arbitrary code execution inside the browser's security sandbox by enticing a victim to visit a specially crafted HTML page.

Exploitation

Active Exploitation: The vulnerability is confirmed to be under active exploitation in the wild ^[4]^[6].
Threat Actors: While active exploitation is confirmed, specific threat actor names or ransomware campaigns associated with this vulnerability have not been publicly attributed in available reports.
Availability: While functional exploit code exists (as evidenced by its active exploitation), public proof-of-concept (PoC) tools are not explicitly detailed in general documentation.
Attack Prerequisites:

* Access: Remote. * Authentication: Not required. * User Interaction: Required; the victim must be enticed to navigate to a crafted HTML page ^[3]^[5].

Affected Products & Patches

Affected Versions: Google Chrome prior to version 153.0.8010.36 ^[2]. The vulnerability also affects other Chromium-based browsers (e.g., Microsoft Edge, Opera) that utilize the impacted V8 engine ^[3].
Patch Availability: The issue was resolved in Google Chrome version 153.0.8010.36 ^[2].
Mitigations: Users should update their browsers immediately. As a secondary defense, configuring web applications to utilize strict Content Security Policy (CSP) headers that disallow inline scripts and restrict script sources to trusted origins can reduce the likelihood of malicious content successfully triggering such vulnerabilities ^[1].

Impact

Successful Exploitation: Allows a remote attacker to execute arbitrary code within the browser's sandbox environment ^[2].
Business Risk: For internet-facing deployments, this poses a high risk as it facilitates drive-by download attacks. Compromised browsers can serve as an entry point for further system exploitation, potentially leading to unauthorized data access, credential theft, or the installation of additional malware on user endpoints.

Sources

CVE-2026-87491 - Vulnerability Details - OpenCVE
Configure web applications to send strict Content‑Security‑Policy headers that disallow inline scripts and require scripts from trusted origins, thereby reducing the chance that malicious content triggers the vulnerability. Generated by OpenCVE AI on September 9, 2026 at 21:57 UTC.
NVD-CVE-2026-87491 - National Vulnerability Database
Description. Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside ...
CVE-2026-87491 — Google Chromium V8 Out of Bounds Write — netVigilance
Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Ed…
Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside ...
Google on Tuesday released updates to patch 230 security vulnerabilities, including one that has come under active exploitation in the wild. The medium-severity vulnerability, assigned the CVE identifier CVE-2026-87491 (CVSS score: N/A), has been described as an out-of-bounds bug in V8, Chrome's Jav…
CVE-2026-87491 | Vulnerability Details
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML…

🟢 CVE-2026-87491