{"id":"CVE-2026-87491","kind":"vulnerability","aliases":["CVE-2026-87491"],"related":[],"title":"Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary…","description":"Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Google Chromium's V8 JavaScript engine has an out-of-bounds write bug that lets a remote attacker run arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. CISA lists it as actively exploited in the wild.","severity":"high","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2026-09-09T00:00:00+00:00","products":[{"name":"Google Chromium V8","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"google chrome","fixed":["153.0.8010.36"],"affected":"< 153.0.8010.36","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browsers","chrome","chromium","edge","endpoints","exploited","opera","vendor"],"not_affected_if":["browser-not-chromium-based","fully-patched-browser"],"how_to_check":"Check the installed browser version (chrome://settings/help in Chrome, edge://settings/help in Edge) and compare it with the fixed version in the vendor advisory.","fix":"Update Chrome, Edge, Opera and other Chromium-based browsers to the latest stable release that includes the vendor fix. Fixed version numbers not stated in the sources.","status":"open","published_at":"2026-09-09T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:36+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T20:31:36Z","model":"claude-haiku-5-5","output":{"fix":"Update Chrome, Edge, Opera and other Chromium-based browsers to the latest stable release that includes the vendor fix. Fixed version numbers not stated in the sources.","summary":"Google Chromium's V8 JavaScript engine has an out-of-bounds write bug that lets a remote attacker run arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. CISA lists it as actively exploited in the wild.","category":"vendor","who_cares":["chrome","edge","opera","chromium","browsers","endpoints"],"confidence":0.7,"analyst_note":"Sources give no fixed version or vendor advisory link; find the Chrome stable release notes for CVE-2026-87491 and confirm the patched build numbers.","how_to_check":"Check the installed browser version (chrome://settings/help in Chrome, edge://settings/help in Edge) and compare it with the fixed version in the vendor advisory.\nunknown","needs_analyst":true,"not_affected_if":["browser-not-chromium-based","fully-patched-browser"],"severity_if_unknown":"high"},"cost_usd":0.000417,"input_tokens":2254,"output_tokens":384,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':148C,174C,205C '-2026':21A,24A '-87491':22A,25A '153.0.8010.36':12A '26':147C,173C,204C 'accord':137C 'action':133C 'activ':78B 'adher':201C 'affect':113C 'allow':13A,94C 'appli':134C 'applic':171C 'arbitrari':19A,59B,100C 'asset':195C 'attack':16A,57B,97C 'base':152C 'bod':146C,172C,203C 'bound':3A,50B,90C 'browser':31B,63B,116C 'bug':52B 'chrome':9A,30A,32B,126C 'chromium':27A,33B,40B,84C,119C 'cisa':74B,131C,144C,161C 'cloud':177C 'code':60B,101C 'complianc':142C 'contain':86C 'could':112C 'craft':71B,107C 'cve':20A,23A 'discontinu':180C 'edg':34B,128C 'endpoint':35B 'engin':44B 'ensur':141C,200C 'evalu':193C 'execut':18A,99C 'exploit':36B,79B 'exposur':198C 'follow':170C 'forens':163C 'googl':8A,39B,83C,125C 'google':26A,29A 'guidanc':159C,175C 'guidelin':207C 'html':72B,108C 'includ':120C 'insid':61B,102C 'instruct':140C 'internet':197C 'javascript':43B 'let':54B 'limit':123C 'list':75B 'lure':66B 'microsoft':127C 'mitig':135C,186C 'multipl':114C 'note':158C,169C 'opera':37B,130C 'out-of-bound':47B 'page':73B,109C 'patch':206C 'prior':10A 'priorit':149C 'product':184C 'remot':15A,56B,96C 'requir':132C,165C 'respons':191C 'risk':154C 'run':58B 'sandbox':64B,104C 'secur':150C 'see':155C,166C 'servic':178C 'stakehold':189C 'triag':164C 'unavail':188C 'updat':151C 'url':156C,167C 'use':181C 'user':68B 'util':118C 'v8':6A,28A,42B,85C 'vendor':38B,139C 'via':105C 'vulner':92C,111C 'web':115C 'wild':82B 'write':4A,51B,91C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-09T00:00:00+00:00","kev":{"dateAdded":"2026-09-09","dueDate":"2026-09-23","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-87491","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87491","severity":null,"published_at":"2026-09-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T17:39:54+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-87491","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87491","severity":null,"published_at":"2026-09-09T01:17:05+00:00","modified_at":"2026-09-21T13:17:11+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}