CVE-2026-87491
Google Chromium V8 Out of Bounds Write Vulnerability
Google Chromium V8Applications & CMS
CVSS
8.8HighExploit odds (EPSS)3.14%Chance of exploitation activity in the next 30 days, higher than 87% of CVEs. Scored 23 Oct 2026FIRST EPSS
CISA required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV
What fixes it
- 153.0.8010.36ChromeCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Timeline
Reports 1
1 outlet mention it. Reports are not confirmation; each links to its source.
Description
Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Text from CVE List
Affected versions 1
- Chromeaffected: 153.0.8010.36 before 153.0.8010.36CVE List
References 4
- chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.htmlReferencevia CVE List
- nvd.nist.gov/vuln/detail/CVE-2026-87491Referencevia CISA KEV
- issues.chromium.org/issues/543557673Referencevia CVE List
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87491Referencevia CVE List