Chromium V8 CVE-2026-87491: Out-of-Bounds Write Exploited — KEV Due Today (September 23)

Today is the federal due date for Chromium’s in-the-wild V8 out-of-bounds write. If your Chrome, Edge or Opera fleet is still below the September stable build, today is the deadline.

What happened

CVE-2026-87491 is an out-of-bounds write in Google Chromium V8 that lets a remote attacker execute arbitrary code inside the sandbox via a crafted HTML page. Google stated an exploit exists in the wild and fixed it in Chrome 153.0.8010.36 (Linux) and 153.0.8010.36/.37 (Windows/macOS). CISA added it to KEV on September 9, 2026 with a federal due date of September 23, 2026.

The bug is in the V8 engine, so every Chromium-based browser carries it. That includes Edge, Opera and Electron apps that lag behind stable.

Why it matters

Browser drive-bys are still the shortest path from “user clicked a link” to a foothold worth chaining with a local EoP. Security Affairs counts this as the seventh actively exploited Chrome zero-day of 2026. With the KEV deadline today, auditors and federal partners will ask for version numbers.

What to do first

• Force-update Chrome/Edge/Opera managed fleets to ≥ 153.0.8010.36/.37 and verify the installed version in inventory. “Update available” doesn’t count.
• Block or quarantine endpoints stuck below the fixed build until they check in.
• Audit Electron/Chromium-embedded apps that pin old V8; escalate vendor patches where you cannot self-update.
• Review browser exploit-attempt telemetry and unusual renderer crashes clustered around untrusted sites in the pre-patch window.

Details

• CVE: CVE-2026-87491 (V8 out-of-bounds write; CWE-787)
• Fixed: Chrome 153.0.8010.36 (Linux); 153.0.8010.36/.37 (Windows/macOS)
• KEV: Added 2026-09-09; federal due 2026-09-23 (today); forensic triage No per CISA entry
• Ransomware use (CISA): Unknown

Hunt / verify

• Export browser version inventory; fail closed on anything < 153.0.8010.36.
• Confirm enterprise update policies actually deployed (ring delays can strand high-value users).
• Spot-check Edge and third-party Chromium browsers. A Chrome-only dashboard will miss them.

Sources

• https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://nvd.nist.gov/vuln/detail/CVE-2026-87491
• https://securityaffairs.com/198757/security/google-fixes-the-seventh-actively-exploited-chrome-zero-day-of-2026.html

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].