CVE-2026-87489: Google Chrome V8 Engine RCE Vulnerability

CVE-2026-87489 Overview

CVE-2026-87489 is a memory corruption vulnerability in the V8 JavaScript engine used by Google Chrome prior to version 153.0.8010.36. A remote attacker can potentially execute arbitrary code inside the Chrome sandbox by convincing a user to install a crafted Chrome extension. The flaw is categorized under [CWE-119] (improper restriction of operations within the bounds of a memory buffer). Google classifies the Chromium security severity as Low, but NVD assigns a higher score because arbitrary code execution remains achievable within the sandbox boundary.

Critical Impact
Successful exploitation allows arbitrary code execution inside the Chrome sandbox through a malicious extension, giving an attacker a foothold in the browser process.

Affected Products

Google Chrome (Desktop) versions prior to 153.0.8010.36
V8 JavaScript engine component shipped with Chrome
Chromium-based browsers that consume the vulnerable V8 build

Discovery Timeline

2026-09-09 - CVE-2026-87489 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-87489

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine embedded in Chrome. V8 performs just-in-time (JIT) compilation and manages complex object lifetimes across generational garbage collection. Memory corruption in this component typically stems from incorrect assumptions about object shape, type, or buffer bounds during optimization or execution. An attacker who controls JavaScript executed inside V8 can craft input that triggers the flaw and corrupts adjacent memory. Once memory is corrupted, the attacker can pivot toward arbitrary code execution within the renderer or extension process.

Because the exploitation vector requires a crafted Chrome extension, the attacker must first convince a user to install the malicious extension or compromise an existing publisher account. Execution remains bounded by the Chrome sandbox, but sandboxed code execution is a common precursor to sandbox escape chains.

Root Cause

The root cause is improper restriction of operations within the bounds of a memory buffer inside V8 [CWE-119]. Chrome addressed the issue in the stable channel release 153.0.8010.36. Further technical details are tracked in Chromium Issue #539453394.

Attack Vector

Exploitation requires user interaction, specifically the installation and use of a crafted Chrome extension. Once installed, the extension supplies attacker-controlled JavaScript that reaches the vulnerable V8 code path. No prior authentication is required, and the vector is network-reachable through extension distribution channels or side-loading.

No public proof-of-concept exploit is available for CVE-2026-87489. Refer to the Google Chrome Desktop Update and the linked Chromium issue for authoritative technical details.

Detection Methods for CVE-2026-87489

Indicators of Compromise

Chrome installations reporting a version earlier than 153.0.8010.36 in browser telemetry or asset inventory
Newly installed Chrome extensions from unverified publishers or sideloaded .crx files
Renderer or extension process crashes with signatures pointing to V8 (v8::internal) frames
Unexpected child processes spawned from chrome.exe shortly after extension installation

Detection Strategies

Inventory Chrome versions across managed endpoints and flag hosts below 153.0.8010.36
Audit installed Chrome extensions and compare against an allowlist maintained by IT
Monitor extension installation events written to Chrome preference files and the registry HKCU\Software\Google\Chrome\Extensions
Correlate browser crash reports with extension install timestamps to surface exploitation attempts

Monitoring Recommendations

Ingest browser process telemetry into a centralized data lake for retrospective hunting on V8-related crashes
Alert on Chrome renderer processes making anomalous outbound network connections after extension installs
Track Chrome update compliance in endpoint management dashboards and enforce automatic updates

How to Mitigate CVE-2026-87489

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed endpoints
Restart Chrome after the update so the patched V8 binary is loaded into memory
Review currently installed extensions and remove any that are unnecessary or untrusted
Enforce enterprise policy that restricts extension installation to an approved allowlist

Patch Information

Google released the fix in the stable channel update documented at the Google Chrome Desktop Update. Upgrading to Chrome 153.0.8010.36 or later remediates CVE-2026-87489. Chromium-based browsers should adopt the corresponding V8 fix once vendors publish downstream builds.

Workarounds

Block installation of unapproved Chrome extensions using the ExtensionInstallBlocklist and ExtensionInstallAllowlist enterprise policies
Disable extension sideloading by setting ExtensionInstallSources to trusted domains only
Use separate browser profiles or isolated virtual machines for high-risk browsing until patching completes

bash

# Configuration example: Chrome enterprise policy to restrict extensions (Windows registry)
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "<approved-extension-id>" /f