CVE-2026-87491: Google Chrome V8 RCE Vulnerability

CVE-2026-87491 Overview

CVE-2026-87491 is an out-of-bounds write vulnerability [CWE-787] in the V8 JavaScript engine used by Google Chrome. The flaw affects Chrome versions prior to 153.0.8010.36 and allows a remote attacker to execute arbitrary code inside the browser sandbox through a crafted HTML page. Exploitation requires the victim to visit an attacker-controlled web page. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.

Critical Impact
Remote attackers can achieve arbitrary code execution inside the Chrome sandbox by luring users to a malicious page, providing an initial foothold for further sandbox escape and system compromise.

Affected Products

Google Chrome versions prior to 153.0.8010.36 (Stable Desktop channel)
Chromium-based builds embedding the vulnerable V8 engine
All supported desktop platforms (Windows, macOS, Linux)

Discovery Timeline

2026-09-09 - CVE-2026-87491 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database
2026-09-09 - Google publishes Stable Channel update advisory for desktop

Technical Details for CVE-2026-87491

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. An out-of-bounds write [CWE-787] occurs when the engine writes data past the boundaries of an allocated buffer. In V8, such flaws typically arise from incorrect bounds tracking in optimized JIT-compiled code, type confusion during speculative optimization, or errors in handling typed arrays and internal object layouts.

An attacker who serves a crafted HTML page containing malicious JavaScript can trigger the write primitive to corrupt adjacent memory. This corruption is commonly weaponized to gain arbitrary read and write within the renderer process, followed by shellcode execution inside the sandboxed process. While the sandbox contains the initial impact, chained sandbox escapes have historically converted V8 memory corruption into full system compromise.

Root Cause

The root cause is improper validation of memory bounds within V8 when processing attacker-controlled JavaScript. The engine performs a write operation that extends beyond the intended object or buffer, corrupting heap metadata or adjacent objects. Google classified the underlying Chromium security severity as Medium, but the exploitation impact yields high confidentiality, integrity, and availability loss per the CVSS vector.

Attack Vector

Exploitation requires network access and user interaction: the victim must load a malicious HTML page in a vulnerable Chrome build. No authentication or elevated privileges are required. Attack scenarios include drive-by downloads from compromised sites, malicious advertising, phishing links, and injected content in third-party iframes.

No public proof-of-concept code is available. Refer to the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for vendor details.

Detection Methods for CVE-2026-87491

Indicators of Compromise

Chrome renderer process crashes with signatures pointing to V8 heap corruption or Oilpan allocator faults
Outbound connections from chrome.exe renderer processes to newly registered or low-reputation domains immediately after page load
Unexpected child processes spawned by Chrome, such as command shells or scripting hosts, indicating a possible sandbox escape chain
Browser telemetry showing users on Chrome versions below 153.0.8010.36

Detection Strategies

Inventory endpoints for outdated Chrome versions using software asset management and EDR telemetry
Correlate web proxy logs with threat intelligence feeds to identify visits to known exploit-serving domains
Monitor for anomalous process lineage where Chrome renderer processes spawn non-standard children
Deploy YARA and behavioral rules for V8 exploitation patterns targeting typed array corruption

Monitoring Recommendations

Enable enterprise browser telemetry and forward Chrome crash reports to a central SIEM
Track the CISA Known Exploited Vulnerabilities Catalog for updated exploitation guidance
Alert on any endpoint reporting Chrome versions below the patched build after the enterprise patch deadline

How to Mitigate CVE-2026-87491

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after installation to ensure the patched V8 engine is loaded into all renderer processes
Prioritize patching for internet-facing users and privileged accounts given confirmed in-the-wild exploitation
Push managed browser updates via Group Policy, Jamf, or MDM to enforce compliance within 24–72 hours

Patch Information

Google released the fix in the Stable Channel update documented in the Google Chrome Update Announcement. Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi should be updated once their vendors incorporate the upstream V8 fix.

Workarounds

Disable JavaScript for untrusted sites via Chrome enterprise policies where operationally feasible
Enforce site isolation and strict URL filtering through a secure web gateway to block known exploit infrastructure
Restrict browser use to allowlisted internal applications on high-value systems until patching completes

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query installed Chrome version via registry
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version

# Enforce minimum version via Chrome Enterprise policy (JSON)
# Place in the managed policies directory
{
  "BrowserSwitcherEnabled": false,
  "RelaunchNotification": 2,
  "RelaunchNotificationPeriod": 86400000
}