Google Chromium V8 Out of Bounds Write Vulnerability
TL;DR 📌
- Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Highest CVSS: 8.8 (High).
- Listed in CISA KEV (2026-09-09) — this is being exploited in the wild.
- Fixed in
153.0.8010.36— upgrade to this release or later. - CVEs: CVE-2026-87491.
What it is
CVE-2026-87491 is an out-of-bounds write in V8, Chromium’s JavaScript and WebAssembly engine. The flaw sits in the engine itself, not in a browser-specific extension or UI component, so it affects any browser built on the vulnerable Chromium codebase.
An attacker needs the target to load a crafted HTML page — no authentication, no local access, and no prior foothold on the machine. The CVSS vector confirms this: network attack vector, low attack complexity, no privileges required, though it does require user interaction (visiting the page). Successful exploitation gives arbitrary code execution inside the browser’s sandbox.
Chromium rates this internally as medium severity, which reflects the sandbox containment — code execution is confined there rather than reaching the host directly. NVD’s CVSS score of 8.8 (High) reflects the network-reachable, low-complexity nature of the trigger rather than a full sandbox escape.
The advisory names Google Chrome specifically, with the fix landing prior to version 153.0.8010.36. Microsoft Edge, Opera and other Chromium-based browsers are noted as potentially affected given the shared V8 engine, but version numbers for those products aren’t given here — consult each vendor’s own release notes for their equivalent fixed build.
This CVE is listed in CISA’s Known Exploited Vulnerabilities catalogue, added 9 September 2026, so it is known to be exploited.
What to do
- Update Google Chrome to 153.0.8010.36 or later. This is the fixed version confirmed by NVD.
- Check Microsoft Edge, Opera, and any other Chromium-based browsers in your estate for their corresponding security updates that incorporate this V8 fix — their version numbering will differ from Chrome’s.
- Given the KEV listing, treat this as a priority patch rather than routine browser maintenance. Confirm auto-update is functioning across managed endpoints rather than assuming it has already applied.
- For fleets managed via GPO or MDM, push a forced browser restart after update — V8 fixes only take effect once the browser process reloads.
- No user interaction beyond viewing a web page is required to trigger this, so browsing restrictions or URL filtering will reduce exposure but won’t substitute for patching.
For leadership 🧭
Executive summary. An attacker who gets a user to view a crafted web page can execute code inside the Chrome sandbox on any unpatched Chromium browser, and this is already being actively exploited according to CISA’s KEV listing. Patch Chrome and check Edge, Opera and other Chromium browsers this week, not on the next routine cycle.
Why it matters:
- The flaw is in V8, the JavaScript/WASM engine shared by Chrome, Edge, Opera and other Chromium-based browsers, so a single fix in one product doesn’t cover the rest of your estate.
- Exploitation requires nothing beyond a user opening a crafted HTML page — no credentials, no local access, no prior compromise.
- CISA’s KEV listing (added 9 September 2026) means this is known to be exploited, not a theoretical risk.
- Code execution is confined to the browser sandbox, but that still gives an attacker a foothold from which further sandbox-escape or privilege-escalation attempts could be launched.
Now / Next / Later:
- Now: Confirm Google Chrome is on 153.0.8010.36 or later across all managed endpoints, and force auto-update where it hasn’t already applied.
- Next: Check Microsoft Edge, Opera and any other Chromium-based browsers in the estate for their equivalent security updates, and push a forced browser restart via GPO/MDM so the fix actually takes effect.
- Later: Build a standing check into patch management that treats KEV-listed browser CVEs as priority-patch triggers rather than waiting for routine update cycles, given how quickly V8 flaws move from disclosure to active exploitation.