Google Chrome V8 Out-of-bounds Write Remote Code Execution Advisory (CVE-2026-87491)

Affected Vendors

Google

Affected Components

Chrome, Chromium

Published Date

2026-09-09

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Google Chrome versions prior to 153.0.8010.36 and Chromium-based browsers

Impact

Remote attackers can execute arbitrary code within the browser sandbox via a crafted HTML page

Mitigation

Immediately update Google Chrome to version 153.0.8010.36 or later

Affected Products & Version Scope

Google Chrome for Desktop (Windows, Mac, and Linux) prior to 153.0.8010.36. Other browsers utilizing the Chromium engine (e.g., Microsoft Edge, Brave) are also likely affected.

Remediation & Live Workaround Commands

PATCH & WORKAROUND

Manual Update: Navigate to chrome://settings/help in your browser to trigger the update check. Ensure the browser is restarted to apply the patch.
Enterprise Deployment: Use Group Policy Objects (GPO) or Chrome Browser Cloud Management to enforce the minimum required version across the fleet.
Linux Update Command:

bash

sudo apt-get update && sudo apt-get install --only-upgrade google-chrome-stable

Recommended Security Control & Mitigation Partner

SentinelOne Singularity AI EDR

Due to active exploitation, immediate update to version 153.0.8010.36 or higher is mandatory for all users.

Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot

Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.

100% MITRE ATT&CK Detection · 1-Click Rollback

See Autonomous Endpoint Protection in Action

Technical Root Cause & Exploitation Mechanics

CVE-2026-87491 identifies an Out-of-bounds (OOB) Write vulnerability (CWE-787) within the V8 JavaScript engine of Google Chrome. By enticing a user to visit a malicious web page, an attacker can trigger a memory corruption flaw that allows writing data past the end of an allocated buffer. This leads to arbitrary code execution within the context of the browser's sandbox. This vulnerability is of critical concern as it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active in-the-wild exploitation. The high EPSS score of 0.94 further underscores the urgency of remediation.

Official Vendor Advisories & References

NVD Original English Description

Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html

Source: chrome-cve-admin@google.com · Release Notes, Vendor Advisory

https://issues.chromium.org/issues/543557673

Source: chrome-cve-admin@google.com · Permissions Required

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87491

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: