Listen to this Post
CVE-2026-87491 is an out-of-bounds write vulnerability in Google Chrome’s V8 JavaScript engine.
It affects Chrome versions prior to 153.0.8010.36.
The flaw is classified as CWE-787: Out-of-bounds Write.
A remote attacker can trigger the issue through a crafted HTML page.
The attacker does not need local access to the target browser.
The vulnerable component is V8, Chrome’s JavaScript and WebAssembly engine.
V8 compiles JavaScript to optimized machine code.
An out-of-bounds write can corrupt memory outside an intended buffer.
Memory corruption in V8 can alter object metadata or control flow data.
Successful exploitation can lead to arbitrary code execution inside the sandbox.
The sandbox limits the blast radius but does not prevent in-sandbox code execution.
Chromium security severity for this CVE is Medium.
The NVD published the CVE on September 09, 2026.
The NVD last modified the entry on September 10, 2026.
The source of the CVE record is Chrome.
The affected CPE is cpe:2.3:a:google:chrome::::::::.
The vulnerable range is up to, excluding, 153.0.8010.36.
The fixed version is 153.0.8010.36 or later.
CISA added the issue to the Known Exploited Vulnerabilities Catalog.
CISA’s vulnerability name is Google Chromium V8 Out of Bounds Write Vulnerability.
CISA added it on September 09, 2026.
CISA’s due date is September 23, 2026.
CISA requires applying mitigations per vendor instructions.
CISA references BOD 26-04 prioritization guidance.
CISA also references Forensics Triage Requirements.
The required action includes evaluating internet exposure.
If mitigations are unavailable, CISA guidance says discontinue use.
The attack vector is remote and user-interaction based via crafted HTML.
The impact includes arbitrary code execution inside the Chrome sandbox.
The primary fix is upgrading Google Chrome to 153.0.8010.36 or later.
DailyCVE Form:
Platform: Google Chrome
Version: prior 153.0.8010.36
Vulnerability : V8 Out-of-bounds Write
Severity: Medium
date: Sep 09 2026
Prediction: Sep 09 2026
(end of form)
What Undercode Say:
Analytics:
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-87491" | jq '.vulnerabilities[bash].cve'
curl -s https://nvd.nist.gov/vuln/detail/CVE-2026-87491 | grep -i "Out-of-bounds"
google-chrome --version
CHROME_VERSION=$(google-chrome --version | awk '{print $3}')
echo "$CHROME_VERSION"
Exploit: (Educational Purposes!)
Educational only d8 --version echo '<html><body><script>/ crafted page test /</script></body></html>' > /tmp/test.html google-chrome --headless --disable-gpu --no-sandbox /tmp/test.html
Protection: from this CVE
google-chrome --version sudo apt update sudo apt install --only-upgrade google-chrome-stable
Impact:
CWE-787 Out-of-bounds Write Remote code execution inside sandbox Known exploited
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
