Fixing and finding

[Jump to remediation plan](#remediation)

CVE ID

# CVE-2026-87491

Published 2026-09-09

Updated 26 days ago

Vendor/s

Google

Product/s

Chromium V8

Version/s

\* > 153.0.8010.36

KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.

CVSS Score (v3.1)

8.8

/ 10

High

Severity Details

Base score

8.8 High

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Table of Contents

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

## Description

CVE-2026-87491 is a high-severity RCE vulnerability in Google Chrome's V8 engine. Learn how to protect your systems from active exploitation.

## Why this matters

"CVE-2026-87491 is a significant security risk because it allows remote code execution (RCE) within the Chromium V8 engine's sandbox. With a CVSS score of 8.8 and its inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog, this flaw is being actively targeted by attackers. Exploitation occurs when a user visits a specially crafted HTML page, making it a high-priority threat for any organization using Chrome or Chromium-based browsers. While the execution is initially sandboxed, such vulnerabilities are frequently chained with sandbox escapes to gain full system control, necessitating immediate remediation to prevent unauthorized access."

## CPE

Google

| Product | Version Start | Version End (excl.) | Status     |
| ------- | ------------- | ------------------- | ---------- |
| chrome  | \*            | 153.0.8010.36       | vulnerable |

## Related weakness (CWE)

CWE-787

## Remediation plan

1

### Apply official patches

Immediately update Google Chrome and Chromium-based browsers to version 153.0.8010.36 or later. Google has released stable channel updates for Windows, Mac, and Linux to address this out-of-bounds write flaw in the V8 engine.

2

### Update affected systems

Ensure all enterprise workstations and servers running Chromium-based applications are updated to versions higher than 153.0.8010.36. Use endpoint management tools to verify that no legacy versions remain in the environment.

3

### Restrict access

Implement web filtering and DNS security to block access to untrusted or high-risk websites. Since the attack vector requires user interaction with a malicious HTML page, reducing exposure to suspicious web zones mitigates the risk of exploitation.

4

### Monitor for exploitation

Utilize EDR and SIEM tools to monitor for unusual browser behavior, such as unexpected child processes spawning from chrome.exe or frequent crashes in the V8 component, which may indicate an attempted out-of-bounds write.

## Detection Guidance

"Detection should focus on identifying crashes in the chrome.exe process or the V8 JavaScript engine. Monitor for memory corruption indicators and unusual shellcode-like patterns in web traffic. Security teams should use EDR signatures to detect heap-based buffer overflows or out-of-bounds write attempts (CWE-787) and watch for unauthorized outbound network connections originating from browser processes following a crash."

## References

[https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop\_0808145027.html Release Notes Vendor Advisory ](https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html)[https://issues.chromium.org/issues/543557673 Permissions Required ](https://issues.chromium.org/issues/543557673)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-87491 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87491)

## Sources

NIST National Vulnerability Database (NVD)

CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)