CVE-2026-87491
Google Chromium V8 Out of Bounds Write Vulnerability
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Deadline for federal agencies: 2026-09-23.
11 articles across 6 outlets · first covered Sep 9, 2026 · latest Sep 24, 2026
Associated threat actors
Coverage timeline
-
Chinese Hackers Exploited Chrome and Windows Zero Days in Espionage Attackssecurityonline.info · Sep 24, 2026
-
China-Linked Groups Exploited Chrome Patch Gap to Target NGOssecurityaffairs.com · Sep 15, 2026
-
Chrome Zero Days Fuel BlueMoon Exploit Kit’s Espionage Surgewww.securityweek.com · Sep 12, 2026
-
CISA Flags Four Actively Exploited Flaws Including Cisco Zero Daysecurityaffairs.com · Sep 10, 2026
-
Chrome Zero Day Chain Targeted NGOs Before Google’s Patch Arrivedsecurityonline.info · Sep 10, 2026
-
Chrome Patches 230 Flaws as Hackers Exploit V8 Bugwww.malwarebytes.com · Sep 10, 2026
-
CISA Warns of Actively Exploited Chromium Flaw Enabling Code Executioncisa.gov · Sep 10, 2026
-
Google Patches Chrome’s Seventh Zero Day of 2026 Under Attacksecurityaffairs.com · Sep 9, 2026
-
Google Fixes Exploited Chrome Zero Day Among 230 Flaws in Version 153www.securityweek.com · Sep 9, 2026
-
Chrome Patches Exploited V8 Zero Day Allowing Code Executionthehackernews.com · Sep 9, 2026
-
Chrome 153 Patches Exploited V8 Zero Day and 229 Flawssecurityonline.info · Sep 9, 2026