CVE-2026-87491: Google Chromium V8 Out of Bounds Write Added to CISA KEV
CISA added CVE-2026-87491, an out of bounds write in Google Chromium V8, to the KEV catalog on 2026-09-09 with a due date of 2026-09-23. Patch Chromium-based browsers to 153.0.8010.36 or later and verify exposure today.
CVE-2026-87491: Google Chromium V8 Out of Bounds Write Added to CISA KEV
TL;DR
CISA added CVE-2026-87491, an out of bounds write in Google Chromium V8, to the Known Exploited Vulnerabilities catalog on 2026-09-09 with a remediation due date of 2026-09-23. Update all Chromium-based browsers (Google Chrome, Microsoft Edge, Opera, and other Chromium derivatives) to the fixed build 153.0.8010.36 or later, then verify version compliance across your fleet. Treat any internet-facing or user-browsing asset as in scope for immediate triage.
What is this vulnerability?
- CVE ID: CVE-2026-87491
- Vendor / product: Google / Chromium V8
- Vulnerability name: Google Chromium V8 Out of Bounds Write Vulnerability
- Weakness: CWE-787 (Out-of-bounds Write)
- CISA KEV status: Yes — added 2026-09-09
- CISA due date: 2026-09-23
- CVSS (v3.1): 8.8 HIGH —
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS: 0.00997 (percentile 0.6105)
- Known ransomware use: Unknown
Definition: CVE-2026-87491 is an out of bounds write in the V8 JavaScript engine used by Google Chromium. Per the official summary, an out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page (Chromium security severity: Medium). Because V8 is shared across Chromium-based browsers, the exposure extends to Google Chrome, Microsoft Edge, Opera, and other Chromium derivatives.
KEV vs CVSS vs EPSS
| Signal | What it measures | How to use it for this CVE |
|---|---|---|
| CISA KEV | Confirmed in-the-wild exploitation | Authoritative trigger for emergency change: CVE-2026-87491 is KEV-listed with a due date of 2026-09-23. Drive patching to this deadline. |
| CVSS 8.8 (HIGH) | Theoretical severity of the flaw | Confirms high confidentiality and integrity impact with network attack vector and user interaction (UI:R). Use it to justify urgency to stakeholders. |
| EPSS 0.00997 (61st pct) | Modeled probability of exploitation in the next 30 days | Low modeled probability, but KEV status overrides EPSS for prioritization. Do not deprioritize based on EPSS alone. |
Step-by-step remediation
- Inventory Chromium-based browsers. Enumerate Google Chrome, Microsoft Edge, Opera, and any other Chromium-derived browser across endpoints, VDI images, golden images, and containers. Note versions and update channels.
- Patch to the fixed build. Update to Chromium 153.0.8010.36 or later per the Google Chrome stable channel advisory. Apply vendor instructions for each browser family (Chrome, Edge, Opera) since they ship on independent release cadences.
- Mitigate where patching is not yet possible. Follow CISA's required action: apply mitigations in accordance with vendor instructions, and if mitigations are unavailable, discontinue use of the product. Evaluate each asset's internet exposure and adhere to BOD 26-04 patching guidance.
- Verify. Confirm the installed version on a representative sample of endpoints and on any internet-facing or high-value user populations. Re-scan after the update window closes.
- Align with BOD 26-04 and forensics triage. Ensure compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk and the associated Forensics Triage Requirements implementation guidance. For cloud services, follow applicable BOD 26-04 guidance.
- Close the ticket with evidence. Record version strings, scan timestamps, and exception approvals. Retain artifacts for audit against the 2026-09-23 due date.
FAQ
Is CVE-2026-87491 in CISA KEV? Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-09.
What is the CISA due date? The remediation due date is 2026-09-23.
Is this vulnerability internet-facing? The attack vector is network-based (AV:N) with user interaction (UI:R) — a remote attacker can trigger it via a crafted HTML page. Any asset where users browse the web, including internet-facing endpoints, should be treated as exposed. Stakeholders are responsible for evaluating each asset's internet exposure.
Is there a ransomware tie? Known ransomware use is listed as Unknown in the source intel. Absence of a confirmed ransomware association does not reduce urgency given KEV status.
Which products are affected? Google Chromium V8, which affects multiple web browsers that utilize Chromium, including but not limited to Google Chrome, Microsoft Edge, and Opera. Fixed in Chrome 153.0.8010.36 and later.
Are there public exploit references? Yes — public PoC references exist on GitHub. Defensive teams should assume exploit code is circulating and prioritize patching accordingly. Do not attempt to reproduce exploits outside authorized testing.