CVE-2026-87491

What is Chromium V8?

V8 is the JavaScript and WebAssembly engine inside Google Chrome and every Chromium-based browser, including Microsoft Edge, Brave, Opera, and Vivaldi. It compiles and runs the script on every web page you visit. That makes it one of the most valuable targets in software: a memory-corruption bug in V8, combined with a sandbox escape, turns a single malicious web page into full code execution on the visitor's machine. V8 flaws are a recurring first stage in targeted-attack and spyware exploit chains, which is why Chrome zero-days are patched on an emergency cadence.

Overview

CVE-2026-87491 is an out-of-bounds write (CWE-787) in V8, rated CVSS 8.8. A remote attacker can execute arbitrary code inside the browser sandbox by luring a victim to a crafted HTML page. Google confirmed an exploit exists in the wild and shipped a fix in the Stable Channel on 2026-09-08. CISA added the CVE to KEV on 2026-09-09. This is Chrome's seventh actively exploited zero-day patched in 2026.

Affected Versions

Other Chromium-based browsers (Edge, Brave, Opera, Vivaldi) are affected until they ship the equivalent V8 fix and should be updated as their vendors release builds.

Technical Details

An out-of-bounds write occurs when V8 writes past the bounds of an allocated buffer. An attacker crafts JavaScript that drives the engine into the vulnerable state, and the OOB write corrupts adjacent heap structures, which can be leveraged into arbitrary code execution within the renderer process.

Crucially, the resulting execution is inside the Chrome sandbox. On its own the bug does not yield full system compromise; a real-world attack pairs it with a separate sandbox-escape vulnerability to break out to the host. That is the standard structure of a browser exploit chain, and CISA's description explicitly scopes the impact to code execution inside the sandbox.

Attack characteristics:

• Authentication: none
• User interaction: required; the victim must visit a malicious or compromised page (CVSS UI:R)
• Vector: network, via web content
• Impact: code execution in the renderer sandbox (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Discovery

The vulnerability was reported to Google on 2026-08-06 by Jihyeon Jeong of the Compsec Lab at Seoul National University, who received a bug-bounty award. Reporting is not fully clear on whether the same submission was independently found under active exploitation; Google confirmed an in-the-wild exploit at patch time.

Exploitation Context

Google stated that an exploit for CVE-2026-87491 exists in the wild but, per its standard practice, withheld the threat actor, targeting, and delivery details until most users had updated. Google fixed it within about two days of the reporting-to-release window being noted publicly. This is the seventh Chrome zero-day of 2026, continuing a year of steady browser exploitation. No public proof of concept has been reported.

Remediation

1. Update Chrome to 153.0.8010.36/.37 (or later) now. Open chrome://settings/help to force the update check, then relaunch the browser so the new version takes effect; an un-relaunched Chrome keeps running the vulnerable build.
2. Update every Chromium-based browser in your environment (Edge, Brave, Opera, Vivaldi) as those vendors ship the corresponding V8 fix.
3. Push the update through management tooling for fleets: use your browser-management policy or endpoint management to accelerate the rollout rather than relying on users to relaunch.
4. Reduce exposure for high-risk users by enabling Enhanced Safe Browsing and, where feasible, site isolation and strict script controls, as defense in depth against browser exploit chains.