Full Report
Google on Thursday released updates to patch 230 security vulnerabilities, including one that has come under active exploitation in the wild. The medium-severity vulnerability, assigned the CVE identifier CVE-2026-87491 (CVSS score: N/A), has been described as an out-of-bounds bug in V8, Chrome's JavaScript and WebAssembly engine. "Out-of-bounds write in V8 in Google Chrome prior to
Analysis Summary
# Vulnerability: Google Chrome V8 Out-of-Bounds Write
## CVE Details
- **CVE ID:** CVE-2026-87491
- **CVSS Score:** N/A (Medium severity assigned by vendor)
- **CWE:** CWE-787 (Out-of-bounds Write)
## Affected Systems
- **Products:** Google Chrome and Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi).
- **Versions:** All versions prior to 153.0.8010.36.
- **Configurations:** Systems running the V8 JavaScript and WebAssembly engine.
## Vulnerability Description
CVE-2026-87491 is an out-of-bounds (OOB) write vulnerability located in V8, the JavaScript and WebAssembly engine used by Google Chrome. The flaw occurs when the engine writes data past the end of the intended buffer. This memory corruption allows a remote attacker to execute arbitrary code within the browser's sandbox environment by tricking a user into visiting a specially crafted HTML page.
## Exploitation
- **Status:** Exploited in the wild (Zero-day).
- **Complexity:** Medium (Technical specifics are currently restricted by Google to prevent further exploitation).
- **Attack Vector:** Network (Remote). The attack is triggered via a malicious website/HTML page.
## Impact
- **Confidentiality:** High (Potential for arbitrary code execution).
- **Integrity:** High (Potential for arbitrary code execution).
- **Availability:** High (Potential for application crashes).
- **Note:** While code execution is achieved, it is currently described as occurring *inside* the sandbox.
## Remediation
### Patches
Update to the following versions or higher:
- **Windows/macOS:** 153.0.8010.36/.37
- **Linux:** 153.0.8010.36
### Workarounds
No specific configuration workarounds are provided. The primary mitigation is a browser update. Users of other Chromium-based browsers should apply vendor-specific updates immediately upon release.
## Detection
- **Indicators of Compromise:** Unusual browser crashes when visiting specific external URLs; unauthorized memory access patterns in V8.
- **Detection methods and tools:** Enterprise environments can monitor for outdated Chrome versions via endpoint management tools. Google utilized AddressSanitizer and MemorySanitizer for internal detection.
## References
- **Vendor Advisory:** hxxps[://]chromereleases[.]googleblog[.]com/2026/09/stable-channel-update-for-desktop_0808145027[.]html
- **NVD Listing:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/cve-2026-87491
- **Source Article:** hxxps[://]thehackernews[.]com/2026/09/chrome-v8-zero-day-exploited-in-wild[.]html