CISA added CVE-2026-87491, an out-of-bounds write in Chromium's V8 JavaScript engine, to the Known Exploited Vulnerabilities catalog on 2026-09-09 with a federal remediation deadline of 2026-09-23.
What Is It
CVE-2026-87491 is an out-of-bounds write (CWE-787) in V8, the JavaScript engine used by Google Chrome and other Chromium-based browsers. Per Google's advisory, the flaw exists in Chrome prior to version 153.0.8010.36 and allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
The CVSS 3.1 score is 8.8 (HIGH), vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges required, but user interaction is required. Google itself rated the Chromium security severity as Medium. NVD's SSVC assessment records exploitation as active, automatable as no, and technical impact as total.
Why It Matters
CISA's KEV listing confirms active exploitation in the wild. The attack path is a drive-by: a user visits or is lured to a malicious page, and code executes in the renderer sandbox. That is a foothold, not full system compromise on its own, but it is the standard first stage of a browser exploit chain.
Known ransomware campaign use is listed as Unknown. The KEV entry's required action directs affected agencies to CISA's Forensics Triage Requirements under BOD 26-04 alongside patching (see Patch Status below).
What's Vulnerable
- Google Chrome: all versions prior to 153.0.8010.36 (
cpe:2.3:a:google:chrome:*) - Other Chromium-based browsers: CISA notes the flaw could affect multiple browsers built on Chromium, "including, but not limited to, Google Chrome, Microsoft Edge, and Opera"
Patch Status
Google shipped a fix in the Stable Channel desktop update referenced in its September 2026 Chrome Releases post. Update Chrome to 153.0.8010.36 or later; users of other Chromium-based browsers should apply their vendor's corresponding update.
CISA's required action: apply mitigations per vendor instructions in compliance with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and adhering to BOD 26-04 patching guidelines. Due date: 2026-09-23.
Sources
- Google Chrome Releases; Stable Channel Update for Desktop
- NVD, CVE-2026-87491
- CISA Known Exploited Vulnerabilities Catalog; CVE-2026-87491
- Chromium Issue Tracker, 543557673 (permissions required)
- CISA BOD 26-04; Prioritizing Security Updates Based on Risk
- CISA BOD 26-04 Implementation Guidance / Forensics Triage Requirements