CVE-2026-87491: Google Patches Seventh Actively Exploited Chrome Zero-Day of 2026
Overview
CVE-2026-87491 is an actively exploited out-of-bounds write vulnerability in the V8 JavaScript and WebAssembly engine used by Google Chrome. A remote attacker can exploit the flaw through a crafted HTML page and execute arbitrary code inside the Chrome sandbox on a vulnerable browser. Google has confirmed that an exploit for the vulnerability exists in the wild.
The Chrome CNA classifies the flaw as CWE-787: Out-of-bounds Write and describes affected Google Chrome versions as those prior to 153.0.8010.36. Google assigns the issue a Medium Chromium security severity. A CVSS base score has not yet been assigned in NVD and is currently listed as N/A. The vulnerability was reported by Jihyeon Jeong of Compsec Lab at Seoul National University on August 6, 2026.
Google addressed the flaw in Chrome 153, with fixed desktop builds including 153.0.8010.36 for Linux and 153.0.8010.36/.37 for Windows and macOS. CISA added CVE-2026-87491 to the Known Exploited Vulnerabilities Catalog on September 9, 2026, with a remediation due date of September 23, 2026.
CVE-2026-87491 - Google Chrome V8 Out-of-Bounds Write
| Vulnerability Name | Google Chrome V8 Out-of-Bounds Write Vulnerability |
|---|---|
| CVE ID | CVE-2026-87491 |
| Component | V8 JavaScript and WebAssembly engine |
| Weakness | CWE-787: Out-of-bounds Write |
| Google Chromium Severity | Medium |
| CVSS Score | Not yet assigned (NVD: N/A) |
| Affected Versions | Google Chrome versions prior to 153.0.8010.36 |
| Fixed Versions | 153.0.8010.36 for Linux; 153.0.8010.36/.37 for Windows and macOS |
| Attack Vector | Remote delivery through a crafted HTML page |
| Confirmed Impact | Arbitrary code execution inside the Chrome sandbox |
| Discovered By | Jihyeon Jeong, Compsec Lab, Seoul National University / Research Intern |
| Reported Date | August 6, 2026 |
| Patch Release | September 8, 2026 |
| CISA KEV Addition | September 9, 2026 |
| CISA Due Date | September 23, 2026 |
| Description | An out-of-bounds write in V8 allows a remote attacker to execute arbitrary code inside the browser sandbox when a vulnerable Chrome instance processes a crafted HTML page. |
Exploit Maturity Assessment
CVE-2026-87491 is beyond the proof-of-concept stage because Google explicitly states that an exploit exists in the wild. CISA independently elevated the issue by adding it to the KEV Catalog. The available authoritative sources do not disclose whether the exploit is broadly available, privately held, or restricted to one or more threat actors.
| Factor | Assessment |
|---|---|
| Exploit Status | Confirmed in-the-wild exploitation |
| Exploit Availability | Not publicly established by Google |
| Source of Exploit Confirmation | Google Chrome Stable Channel advisory and CISA KEV |
| Exploit Reliability | Operational exploitation is confirmed, but no formal reliability or success-rate assessment is available |
| CISA KEV | Yes, added September 9, 2026 |
Proof of Concept
Google has not released exploit code or a public proof of concept in its security advisory. The Chrome CNA record confirms the high-level exploitation condition, namely a crafted HTML page that can trigger the V8 memory-safety flaw and lead to arbitrary code execution inside the sandbox.
| Publicly Available | No official Google PoC is provided |
|---|---|
| Authoritative Exploit Evidence | Google confirms an exploit exists in the wild |
| Known Trigger | Crafted HTML page processed by a vulnerable Chrome browser |
| Expected Outcome | Arbitrary code execution inside the Chrome sandbox |
Reproducibility
The vulnerability is not fully reproducible from the public Google advisory because the technical bug details remain restricted. Public authoritative information establishes that the flaw is an out-of-bounds write in V8, is remotely triggerable through crafted HTML, and can execute code inside the sandbox. The exact V8 object state, memory corruption sequence, JavaScript pattern, and exploitation primitive have not been publicly documented by Google.
A safe validation process should therefore focus on confirming affected Chrome versions and successful deployment of fixed builds rather than attempting to reproduce the exploit while Google continues to restrict the underlying issue details.
Time-to-Exploit Analysis
| Metric | Assessment |
|---|---|
| Reported to Google | August 6, 2026 |
| Patch Release | September 8, 2026 |
| CVE Record Publication | September 9, 2026 |
| CISA KEV Addition | September 9, 2026 |
| Time from Researcher Report to Patch | Approximately 33 days |
| Time from Patch to CISA KEV Addition | Approximately 1 day |
| Exact First Exploitation Date | Not publicly disclosed |
| Risk Interpretation | Immediate. Google and CISA confirm active exploitation, and affected browsers can be reached through malicious web content. |
Active Exploitation & Threat Actors
Exploitation Observed in the Wild: Yes. Google confirms that an exploit for CVE-2026-87491 exists in the wild, and CISA lists the vulnerability in KEV.
Associated Threat Actors: Google has not publicly attributed the exploitation to a named threat actor, APT group, ransomware operator, or initial access broker.
Campaign Details: No authoritative campaign name, targeted sector, victim geography, or attack scale has been publicly disclosed.
Attack Techniques Observed: The authoritative record establishes malicious web content as the delivery path and V8 memory corruption as the exploitation primitive. Google has not disclosed the surrounding exploit chain.
Sandbox Escape: The CVE record states that arbitrary code execution occurs inside the Chrome sandbox. No authoritative source reviewed confirms that CVE-2026-87491 alone escapes the sandbox or achieves host-level code execution.
Vulnerability Timeline
| Event | Date |
|---|---|
| Researcher Report | August 6, 2026 |
| Google Stable Patch Release | September 8, 2026 |
| Google Confirms Exploit in the Wild | September 8, 2026 |
| CVE Record Published | September 9, 2026 |
| CISA KEV Addition | September 9, 2026 |
| CISA Remediation Due Date | September 23, 2026 |
| Exact First Exploitation Date | Not publicly disclosed |
Root Cause Analysis
CVE-2026-87491 is classified as an out-of-bounds write in V8. An out-of-bounds write occurs when software writes data beyond the memory region that was allocated for the target object or buffer. This can corrupt adjacent memory and alter program state in ways that may enable attacker-controlled execution.
For this vulnerability, the Chrome CNA confirms that a remote attacker can trigger the flaw through a crafted HTML page and achieve arbitrary code execution inside the Chrome sandbox. Google has not yet published the detailed V8 code path, affected internal object type, or memory-management condition that produces the out-of-bounds write.
Because the technical issue details remain restricted, claims about the exact JavaScript construct, JIT behavior, heap layout, or exploitation primitive should be avoided until Google or Chromium publishes the underlying bug information.
Impact
Successful exploitation allows attacker-controlled code to execute inside the Chrome sandbox when a victim opens or is directed to crafted web content. This gives the attacker control within the compromised browser execution context and can expose data and functionality available inside that sandboxed environment.
The vulnerability is especially important because browsers routinely process untrusted web content. However, the official CVE wording limits the confirmed impact to code execution inside the sandbox. A separate sandbox escape or additional vulnerability would normally be required to move from browser-level code execution to broader operating-system compromise unless another security boundary is bypassed.
Post-Exploitation Details
Google has not disclosed what attackers do after successful exploitation of CVE-2026-87491. No authoritative source currently identifies a malware payload, persistence mechanism, credential-theft activity, command-and-control infrastructure, or lateral-movement sequence associated with the observed attacks.
| Capability | Assessment |
|---|---|
| Code Execution | Confirmed inside the Chrome sandbox |
| Sandbox Escape | Not established for CVE-2026-87491 alone |
| Privilege Escalation | Not disclosed |
| Persistence | Not disclosed |
| Credential Access | Not disclosed |
| Data Exfiltration | Not disclosed |
| Command and Control | Not disclosed |
MITRE ATT&CK Mapping
| CVE | Tactic | Technique | ID |
|---|---|---|---|
| CVE-2026-87491 | Initial Access | Drive-by Compromise, malicious web content can be used to exploit a vulnerable browser when the victim visits the crafted page | T1189 |
| CVE-2026-87491 | Execution | Exploitation for Client Execution, exploitation of a client-side browser vulnerability can produce code execution in the browser context | T1203 |
Vulnerability Chaining Opportunities
CVE-2026-87491 provides code execution inside the Chrome sandbox, which makes it a plausible first stage in a browser exploit chain. A separate sandbox escape, privilege-escalation flaw, or operating-system vulnerability could potentially be used after browser compromise to gain broader control of the endpoint.
No authoritative source reviewed has identified the second-stage vulnerability, if any, used in the observed attacks. The appropriate defensive interpretation is therefore that CVE-2026-87491 can serve as a browser code-execution primitive, while any complete host-compromise chain remains undisclosed.
Detection and Monitoring
Because Google has not published indicators of compromise or exploit signatures, detection should focus on browser version exposure and suspicious behavior around Chrome processes. Organizations should inventory Chrome installations and confirm that vulnerable builds have been upgraded.
- Identify Chrome desktop versions earlier than 153.0.8010.36.
- Prioritize systems used for web browsing against untrusted or external sites.
- Monitor Chrome renderer crashes or abnormal process termination where endpoint telemetry is available.
- Investigate unusual child processes or process injection behavior associated with Chrome.
- Review web proxy and secure web gateway telemetry for suspicious destinations associated with browser exploitation investigations.
- Use endpoint security telemetry to investigate unexpected activity immediately following browser sessions.
- Do not rely on IOC blocking alone because Google has not published campaign-specific infrastructure.
Risk Assessment
| Dimension | Assessment | Reason |
|---|---|---|
| Google Chromium Security Severity | Medium | Google labels CVE-2026-87491 as Medium in the Chrome release advisory |
| CVSS Severity | Not yet assigned | NVD currently lists the CVSS score as N/A |
| Technical Impact | High | Arbitrary code execution inside the Chrome sandbox |
| Attack Vector | Remote | Crafted HTML page can trigger the vulnerable V8 path |
| User Interaction | Required | The victim must process attacker-controlled web content, typically by visiting a malicious or compromised page |
| Exploit Maturity | Weaponized | Google confirms an exploit exists in the wild |
| CISA KEV | Listed | Added September 9, 2026 |
| Patch Availability | Available | Chrome 153 stable builds contain the fix |
| Overall Operational Risk | High | Active exploitation and routine exposure to untrusted web content increase practical urgency despite Google's Medium product severity label |
The operational urgency is higher than the vendor severity label alone might suggest. Google has confirmed exploitation in the wild, and CISA has placed the vulnerability in KEV. Defenders should therefore prioritize CVE-2026-87491 based on exploitation status, browser exposure, and code-execution impact rather than relying only on the Medium Chromium severity classification.
Patch and Mitigation
Google has released fixed Chrome 153 builds for desktop platforms. Users and administrators should update Chrome to the applicable fixed version or later and relaunch the browser so the updated binary is active.
| Platform | Fixed Stable Version |
|---|---|
| Windows | 153.0.8010.36/.37 |
| macOS | 153.0.8010.36/.37 |
| Linux | 153.0.8010.36 |
Organizations should verify the running version after deployment because Chrome updates may be staged over several days or weeks. CISA's KEV entry sets a remediation due date of September 23, 2026 for applicable federal environments under its current directive framework.
Remediation Recommendations
Immediate actions should update all affected Chrome desktop installations to version 153.0.8010.36/.37 on Windows and macOS or 153.0.8010.36 on Linux, or to any later supported build. Browser relaunch should be enforced where required so the patched version replaces the vulnerable running process.
Near-term actions should verify update compliance across managed endpoints, review systems that remained on vulnerable versions after September 8, and investigate unusual browser or endpoint activity where users may have encountered malicious web content during the exposure window.
Long-term improvements should include enforced browser auto-update policies, rapid deployment SLAs for KEV-listed browser vulnerabilities, browser version inventory, endpoint detection coverage for browser child-process anomalies, and web filtering controls that reduce exposure to malicious or compromised sites.
Instantly Fix Risks with Saner Patch Management
Saner Patch Management is a continuous, automated, and integrated patch management solution that helps organizations rapidly remediate security risks across Windows, Linux, macOS, and a broad range of third-party applications.
The platform supports automated deployment workflows, patch testing, compliance reporting, and rollback capabilities to help reduce operational risk while ensuring actively exploited vulnerabilities are addressed quickly across enterprise environments.
Experience the fastest and most accurate patching software here.
