CVE-2026-87491: Google Chromium V8 Out of Bounds Write Added to CISA KEV
CISA added CVE-2026-87491, an out of bounds write in Google Chromium V8, to the KEV catalog on 2026-09-09 with a due date of 2026-09-23. Patch Chromium-based browsers to 153.0.8010.36 or later and verify exposure today.
CVE-2026-87491: Google Chromium V8 Out of Bounds Write Added to CISA KEV
TL;DR
CISA added CVE-2026-87491, an out of bounds write in Google Chromium V8, to the Known Exploited Vulnerabilities catalog on 2026-09-09 with a remediation due date of 2026-09-23. Update all Chromium-based browsers (Google Chrome, Microsoft Edge, Opera, and other Chromium derivatives) to the fixed build 153.0.8010.36 or later, then verify version compliance across your fleet. Treat any internet-facing or user-browsing asset as in scope for immediate triage.
What this is
CVE-2026-87491 is an out of bounds write in the V8 JavaScript engine used by Google Chromium. Per the official summary, an out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page (Chromium security severity: Medium). Because V8 is shared across Chromium-based browsers, the exposure extends to Google Chrome, Microsoft Edge, Opera, and other Chromium derivatives.
- CVE ID: CVE-2026-87491
- Vendor / product: Google / Chromium V8
- Vulnerability name: Google Chromium V8 Out of Bounds Write Vulnerability
- Weakness: CWE-787 (Out-of-bounds Write)
- CISA KEV status: Yes — added 2026-09-09
- CISA due date: 2026-09-23
- CVSS (v3.1): 8.8 HIGH —
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS: 0.00997 (percentile 0.6105)
- Known ransomware use: Unknown
Why it matters
CISA KEV listing means confirmed in-the-wild exploitation, which is an authoritative trigger for emergency change. The remediation due date is 2026-09-23. CVSS 8.8 (HIGH) confirms high confidentiality and integrity impact with a network attack vector and user interaction (UI:R), which justifies urgency to stakeholders. EPSS is 0.00997 (61st percentile), a low modeled probability of exploitation in the next 30 days, but KEV status overrides EPSS for prioritization — do not deprioritize based on EPSS alone. Known ransomware use is listed as Unknown in the source intel; absence of a confirmed ransomware association does not reduce urgency given KEV status.
How it works
CVE-2026-87491 is an out of bounds write in V8, the JavaScript engine used by Google Chromium. Per the official summary, an out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The attack vector is network-based (AV:N) with user interaction (UI:R). The fixed build is Chromium 153.0.8010.36 or later. Because V8 is shared across Chromium-based browsers, the exposure extends to Google Chrome, Microsoft Edge, Opera, and other Chromium derivatives, which ship on independent release cadences.
Detection and response
The hypothesis is that an asset in your fleet is running a Chromium-based browser older than 153.0.8010.36 and is therefore exposed to CVE-2026-87491. Evidence that confirms or rejects it: the installed version string on each endpoint, VDI image, golden image, and container; a match against the fixed build 153.0.8010.36 or later; and a match against the CISA KEV entry and the Google Chrome stable channel advisory. Public PoC references exist on GitHub, so defensive teams should assume exploit code is circulating and prioritize patching accordingly. Do not attempt to reproduce exploits outside authorized testing.
What to do
- Inventory Chromium-based browsers. Enumerate Google Chrome, Microsoft Edge, Opera, and any other Chromium-derived browser across endpoints, VDI images, golden images, and containers. Note versions and update channels.
- Patch to the fixed build. Update to Chromium 153.0.8010.36 or later per the Google Chrome stable channel advisory. Apply vendor instructions for each browser family (Chrome, Edge, Opera) since they ship on independent release cadences.
- Mitigate where patching is not yet possible. Follow CISA's required action: apply mitigations in accordance with vendor instructions, and if mitigations are unavailable, discontinue use of the product. Evaluate each asset's internet exposure and adhere to BOD 26-04 patching guidance.
- Verify. Confirm the installed version on a representative sample of endpoints and on any internet-facing or high-value user populations. Re-scan after the update window closes.
- Align with BOD 26-04 and forensics triage. Ensure compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk and the associated Forensics Triage Requirements implementation guidance. For cloud services, follow applicable BOD 26-04 guidance.
- Close the ticket with evidence. Record version strings, scan timestamps, and exception approvals. Retain artifacts for audit against the 2026-09-23 due date.
FAQ
Is CVE-2026-87491 in CISA KEV? Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-09.
What is the CISA due date? The remediation due date is 2026-09-23.
Is this vulnerability internet-facing? The attack vector is network-based (AV:N) with user interaction (UI:R) — a remote attacker can trigger it via a crafted HTML page. Any asset where users browse the web, including internet-facing endpoints, should be treated as exposed. Stakeholders are responsible for evaluating each asset's internet exposure.
Is there a ransomware tie? Known ransomware use is listed as Unknown in the source intel. Absence of a confirmed ransomware association does not reduce urgency given KEV status.
Which products are affected? Google Chromium V8, which affects multiple web browsers that utilize Chromium, including but not limited to Google Chrome, Microsoft Edge, and Opera. Fixed in Chrome 153.0.8010.36 and later.
Are there public exploit references? Yes — public PoC references exist on GitHub. Defensive teams should assume exploit code is circulating and prioritize patching accordingly. Do not attempt to reproduce exploits outside authorized testing.