--- schema: 1 kind: vulnerability title: "CVE-2026-87491 — Google Chrome: V8 out-of-bounds write exploited in the wild, patched in Chrome 153 (seventh exploited Chrome zero-day of 2026)" headline: "Google ships an emergency Chrome fix for a seventh actively exploited V8 zero-day this year" summary: > Google's Chrome 153 stable release (2026-09-08) fixes CVE-2026-87491, an out-of-bounds write in the V8 JavaScript engine that Google confirms is already being exploited via a crafted HTML page. CERT-FR and NCSC-NL both flagged the CVE within a day of release; every Chromium-derived browser needs the equivalent update. discovered_at: "2026-09-10T04:35:00Z" updated_at: null event_date: "2026-09-08" run_id: 2026-09-10T0410Z-intel priority: high immediate_action: null tags: [vulnerabilities, zero-day, actively-exploited, rce, cisa-kev] regions: [global] sectors: [public-sector] entities: ["product:google-chrome", "product:microsoft-edge"] techniques: [T1189, T1203] affected_products: ["Google Chrome", "Microsoft Edge"] cves: - id: CVE-2026-87491 cvss: "8.8" epss: "0.0029" type: rce vector: user-interaction auth: pre-auth status: [exploited, cisa-kev, patch-available] affected: "< 153.0.8010.36 (Windows/Mac), < 153.0.8010.36 (Linux)" fixed: "153.0.8010.36/.37 (Windows/Mac), 153.0.8010.36 (Linux)" sources: - url: "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html" publisher: "Google Chrome Releases" date: "2026-09-08" role: primary - url: "https://www.helpnetsecurity.com/2026/09/09/google-chrome-cve-2026-87491-zero-day-flaw/" publisher: "Help Net Security" date: "2026-09-09" role: corroborating - url: "https://thehackernews.com/2026/09/chrome-v8-zero-day-exploited-in-wild.html" publisher: "The Hacker News" date: "2026-09-09" role: corroborating - url: "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1139/" publisher: "CERT-FR / ANSSI" date: "2026-09-09" role: corroborating - url: "https://advisories.ncsc.nl/2026/ncsc-2026-0354.html" publisher: "NCSC-NL" date: "2026-09-09" role: corroborating - url: "https://euvdservices.enisa.europa.eu/api/search?text=CVE-2026-87491" publisher: "ENISA EUVD" date: "2026-09-09" role: corroborating - url: "https://www.cisa.gov/news-events/alerts/2026/09/09/cisa-adds-four-known-exploited-vulnerabilities-catalog" publisher: "CISA" date: "2026-09-09" role: corroborating - url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" publisher: "CISA Known Exploited Vulnerabilities Catalog (JSON feed)" date: "2026-09-09" role: corroborating closed_sources: [] evidence: - quote: "Google is aware that an exploit for CVE-2026-87491 exists in the wild." publisher: "Google (via Help Net Security)" - quote: "Out-of-bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page." publisher: "NVD (via The Hacker News)" - quote: "Google reports that the vulnerability tracked as CVE-2026-87491 is being actively exploited." original: "Google meldt dat de kwetsbaarheid met kenmerk CVE-2026-87491 actief wordt misbruikt." publisher: "NCSC-NL (advisory NCSC-2026-0354)" verification: multi-source sourcing_note: null confidence: high references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - "Update Chrome, Edge and every other Chromium-based browser in the fleet to ≥153.0.8010.36 now — this is the seventh actively-exploited Chrome zero-day patched in 2026, and Google has disclosed no interim mitigation short of the update." updates: [] migrated_from: null --- Google's Chrome 153 stable release (2026-09-08, versions 153.0.8010.36/.37 Windows/Mac, 153.0.8010.36 Linux) fixes 230 security bugs, including CVE-2026-87491, an out-of-bounds write in V8 that Google confirms is being exploited: "Google is aware that an exploit for CVE-2026-87491 exists in the wild" ([Google, via Help Net Security, 2026-09-09](https://www.helpnetsecurity.com/2026/09/09/google-chrome-cve-2026-87491-zero-day-flaw/)). NVD describes the mechanism as allowing "a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page" ([NVD, via The Hacker News, 2026-09-09](https://thehackernews.com/2026/09/chrome-v8-zero-day-exploited-in-wild.html)) — user interaction (visiting or being served the page) is required, but no authentication or special access. ENISA's EUVD records a CVSS 3.1 base score of 8.8 ([ENISA EUVD, 2026-09-09](https://euvdservices.enisa.europa.eu/api/search?text=CVE-2026-87491)); Google has disclosed no detail on the exploitation vector, victims, or actor, consistent with its practice of withholding detail until most users have updated. CERT-FR and NCSC-NL both independently issued advisories within a day of release ("Google reports that the vulnerability tracked as CVE-2026-87491 is being actively exploited," translated from Dutch — [NCSC-NL, advisory NCSC-2026-0354, 2026-09-09](https://advisories.ncsc.nl/2026/ncsc-2026-0354.html)), and CISA added the CVE to KEV the same day ([CISA, 2026-09-09](https://www.cisa.gov/news-events/alerts/2026/09/09/cisa-adds-four-known-exploited-vulnerabilities-catalog)), with a due date of 2026-09-23 ([CISA KEV catalog, 2026-09-09](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)). This is the seventh Chrome zero-day Google has confirmed under active exploitation in 2026; every Chromium-derived browser (Edge, Brave, Opera, Vivaldi) inherits the same V8 engine and needs the equivalent update. **Defender takeaway:** treat this as a fleet-wide browser patch, not an isolated Chrome update — confirm Edge and any other Chromium-based browser in the estate reached an equivalent fixed build, since Google's practice of withholding exploitation detail means there is no vendor-published indicator to hunt for.