CVE-2026-87491: Google Chrome V8 out-of-bounds write enables sandbox code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is remotely reachable with a high CVSS score of 8.8 and is listed in CISA KEV, though exploitation requires user interaction and EPSS is low.

What it is

Chrome before 153.0.8010.36 contains an out-of-bounds write in the V8 JavaScript engine. A crafted HTML page can trigger the memory corruption, and because V8 sits inside the renderer sandbox, the flaw is rated as allowing code execution inside that sandbox. It matters because Chrome is widely deployed and the bug is remotely reachable through ordinary browsing.

Impact

An attacker who lands the crafted page can corrupt V8 memory and execute arbitrary code within the browser sandbox. That gives a foothold in the renderer process, which is the usual starting point for a full browser compromise chain.

Attack surface

Reached over the network by loading a crafted HTML page; the CVSS vector shows no privileges required but user interaction required, meaning the victim must open or be directed to the page. No authentication is needed to serve the page.

Exploitation

CVE-2026-87491 was added to CISA KEV on 2026-09-09 with a remediation due date of 2026-09-23, indicating known exploitation. EPSS is low at roughly 1 percent for 30 days, and no ransomware campaign use is documented.

What to do

• Update Chrome to 153.0.8010.36 or later on all platforms, prioritizing internet-facing and high-value users.
• Track the CISA KEV due date of 2026-09-23 and confirm remediation under BOD 26-04 guidance.
• If immediate patching is not possible, reduce exposure by restricting untrusted web content and enforcing site isolation where feasible.
• Verify managed fleets actually applied the update rather than relying on auto-update assumptions.
• Review Chromium-based browsers and embedded Chromium components for the same V8 fix.

Detection

• Hunt for Chrome processes spawning unexpected child processes or making anomalous network connections after browsing activity.
• Monitor for crashes in the renderer or V8 modules that cluster around user visits to untrusted sites.
• Check endpoint telemetry for exploitation artifacts in browser memory or unusual script execution patterns tied to Chrome.
• Confirm version inventory to find hosts still below 153.0.8010.36.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.