Google Chromium V8 Out of Bounds Write Vulnerability (CVE-2026-87491)

What is affected, what to do

Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Conflicting version data — version display is hidden until the data is resolved.

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Update Google Chrome to 153.0.8010.36 or later on all managed clients, terminal servers (RDS/Citrix) and jump hosts. Force a browser relaunch, because a downloaded update does nothing until the browser restarts and long-lived sessions stay exposed.
   • Find and patch every other Chromium-based browser (Microsoft Edge, Opera, Brave, Vivaldi). Each vendor has released a patch; look up the exact version in the vendor advisory. For Edge, check the Microsoft Security Update Guide entry for CVE-2026-87491.
   • Reconcile software inventory via MDM, Intune, SCCM or EDR and flag every endpoint running Chrome < 153.0.8010.36 as non-compliant. Include per-user installs under %LOCALAPPDATA%\Google\Chrome, which often bypass central patching.
   • Enforce a relaunch deadline via policy: set RelaunchNotification=2 and RelaunchNotificationPeriod to no more than 4-8 h. Edge uses the equivalent policies of the same name.
   • Prioritise high-value user groups: admins, finance, executives, and OT/engineering workstations with web access. Patch these first and review their telemetry.
2. 02

   Runbook step 2

   Mitigation layers

   • Browser configuration (shrink the V8 attack surface): disable JIT for untrusted sites. In Chrome, set DefaultJavaScriptJitSetting=2 and allow-list required business domains via JavaScriptJitAllowedForSites. In Edge, set EnhanceSecurityMode to "Strict". Many V8 memory-corruption bugs depend on the JIT path.
   • Network/proxy layer: on the secure web gateway, block or isolate newly registered, uncategorised and malvertising-classified domains. Consider remote browser isolation for high-risk user groups.
   • Endpoint hardening: use EDR custom rules, WDAC or AppLocker to block browser renderers from spawning child processes such as chrome.exe/msedge.exe → cmd.exe, powershell.exe, wscript.exe, mshta.exe, rundll32.exe. Confirm that no shortcut or launcher passes --no-sandbox.
   • IAM / least privilege: remove local admin rights. Initial code execution is confined to the sandbox. Attackers typically chain this kind of bug with a sandbox escape or privilege escalation, and missing admin rights make that second stage harder.
   • Embedded Chromium runtimes: Electron apps and CEF-based software embed V8 and may be affected. Ask those vendors for builds with the fixed Chromium baseline. Until then, restrict opening external links inside these apps.
3. 03

   Runbook step 3

   Detection rules

   • EDR/Sysmon EID 1 — anomalous process ancestry: renderer processes never legitimately spawn shells. KQL: DeviceProcessEvents | where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","opera.exe") and InitiatingProcessCommandLine has "--type=renderer" and FileName in~ ("cmd.exe","powershell.exe","rundll32.exe","mshta.exe","wscript.exe")
   • Crash patterns as exploit signal: watch for clustered renderer crashes after visits to the same domain. Sources are Windows Application log Event ID 1000/1001 with faulting module chrome.dll/msedge.dll and Crashpad dumps under User Data\Crashpad\reports. Correlate with proxy logs (same host, ±2 min).
   • Sysmon EID 11 / EID 13 — post-exploitation persistence: alert when a browser process writes executable file types (.exe, .dll, .ps1, .hta) outside Downloads. Also alert on Run-key changes whose process tree traces back to a browser.
   • Proxy/Zeek telemetry: look for first-seen connections to domains younger than 30 days immediately preceding a renderer crash or anomalous child process. Also look for outbound connections to bare IPs (ssl.log without SNI) shortly after page load.
   • Compliance detection: run a daily query for Chrome < 153.0.8010.36. Splunk: index=inventory product="Google Chrome" | where version<"153.0.8010.36" (use a proper version-aware comparison). Track hits as open risk in vulnerability management.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Source: Microsoft Security Update Guide, pwn.watch, Debian LTS Advisories, paloalto_rss, cvelistv5, NVD (NIST), Debian Security Advisories, CISA KEV Catalog, BSI WID Portal, BSI CSAF

Vendors and products

• Debian Chromium
• Google Google Chrome

Weakness classes (CWE)

• CWE-787Out-of-bounds Write

  Base

  The product writes data past the end, or before the beginning, of the intended buffer.

  Entry at MITRE CWE-787

References & sources

• chromereleases.googleblog.com2026/09/stable-channel-update-for-desktop_0808145027.html
• issues.chromium.orgissues/543557673
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87491government-resource
• pwn.watchpwn.watch: Chrome zero-day CVE-2026-87491 (V8 OOB write)pwn-watch
• bleepingcomputer.comBleepingComputer: seventh Chrome zero-daypwn-watch
• securityweek.comSecurityWeek Chrome 153pwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 10.09.2026NVD analysis modifiedNVD

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87491
   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference type	added	—	CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87491 Types: US Government Resource

   Source identifier: nvd@nist.gov

2. 10.09.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: no

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2026-87491","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-09T19:50:19.378603Z"}	{"id":"CVE-2026-87491","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-09T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

3. 09.09.2026CISA KEV entry updated9119a7d8…

   4 individual changes: Date Added, Due Date, Required Action, Vulnerability Name

   Show 4 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Date Added	added	—	2026-09-09
   Due Date	added	—	2026-09-09
   Required Action	added	—	2026-09-09
   Vulnerability Name	added	—	2026-09-09

   Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725

4. 09.09.2026Initial analysis by NVDNVD

   Newly listed as affected:

   • Google Chrome (before 153.0.8010.36)

   New references:

   • https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html
   • https://issues.chromium.org/issues/543557673
   Show 3 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Product configuration	added	—	OR *cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* versions up to (excluding) 153.0.8010.36
   Reference type	added	—	Chrome: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html Types: Release Notes, Vendor Advisory
   Reference type	added	—	Chrome: https://issues.chromium.org/issues/543557673 Types: Permissions Required

   Source identifier: nvd@nist.gov

5. 09.09.2026Record modifiedCISA ADP

   CVSS V3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

   CISA assessment (SSVC): exploitation: none known, automatable: no

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   CVSS	added	—	AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
   SSVC assessment	added	—	{"id":"CVE-2026-87491","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-09T10:29:12.810434Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Linked advisories

• Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP MalwareThe Hacker News23.09.2026
• Multiples vulnérabilités dans Microsoft Edge (14 septembre 2026)CERT-FR (ANSSI)14.09.2026
• Attackers are weaponizing the gap between Chromium fixes and Chrome patchesCSO Online11.09.2026
• NCSC-2026-0354 [1.00] [M/H] Kwetsbaarheid verholpen in Google ChromeNCSC-NL09.09.2026
• Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside SandboxThe Hacker News09.09.2026
• Multiples vulnérabilités dans Google Chrome (09 septembre 2026)CERT-FR (ANSSI)09.09.2026