CVE-2026-87491: Google Chromium V8 Out-of-Bounds Write RCE (KEV)

CVE-2026-87491 is an out-of-bounds write in the V8 JavaScript engine that Chrome and other Chromium-based browsers (Edge, Opera) use, letting a remote attacker who gets a target to load a crafted HTML page execute arbitrary code inside the renderer sandbox; CISA added it to KEV within a day of the fix shipping.

CVE-2026-87491 is an out-of-bounds write (CWE-787) in V8, the JavaScript engine shared by Google Chrome and other Chromium-based browsers. NVD's description states it "allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page" in Chrome prior to 153.0.8010.36 (NVD).

NVD lists this CVE's status as "Analyzed," but the only CVSS metric on record is a CVSS v3.1 score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) attributed to CISA's NVD-authorized data publisher (ADP) feed, not to NVD's own analysts. Because that score is a Secondary (ADP) metric rather than an NVD Primary one, this page leaves cvss_score unset instead of presenting 8.8 as NVD-confirmed (NVD).

Google's own Chrome Releases blog post for the 2026-09-08 Stable channel update lists the fix directly: "[$2,000] [543557673] Medium CVE-2026-87491: Out of bounds write in V8. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-08-06," and confirms the fixed build as Chrome 153.0.8010.36 for Linux (153.0.8010.36/.37 for Windows/Mac). Chromium's own internal severity rating for the bug is "Medium" — notably lower than the 8.8 ADP score and the CVE's fast-track KEV addition would suggest, a reminder that Chromium's bug-bounty severity and CVSS/KEV urgency are scored on different criteria (Google Chrome Releases, Stable Channel Update for Desktop, 2026-09-08).

CISA added CVE-2026-87491 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-09, one day after the patched build shipped, with a required-action due date of 2026-09-23. The KEV entry explicitly notes the flaw "could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera," and known ransomware campaign use is listed as "Unknown" (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.03507 (89.16th percentile) — modest for a KEV entry, consistent with Chrome's fast auto-update cycle limiting the exploitation window (FIRST EPSS).

Because the V8 engine is shared across the Chromium ecosystem, any Chromium-based browser (Chrome, Edge, Opera, Brave, and others) should be updated past the equivalent of Chrome 153.0.8010.36 without waiting for a browser-specific advisory; most auto-update, but organizations managing browser versions centrally should verify the rollout reached all endpoints.

• Out-of-bounds write in V8 lets a remote attacker execute arbitrary code inside the Chrome sandbox via a crafted HTML page; affects Chrome before 153.0.8010.36. — NVD
• NVD status is 'Analyzed' but the only CVSS metric (3.1, 8.8) is a CISA-ADP Secondary score, not an NVD Primary one; no NVD-confirmed score exists. — NVD
• Fixed in Chrome 153.0.8010.36 (Linux)/153.0.8010.36-.37 (Windows/Mac), announced 2026-09-08; bug 543557673 reported by Jihyeon Jeong, rated 'Medium' by Chromium's own severity scale, $2,000 bounty. — Google Chrome Releases, Stable Channel Update for Desktop
• Added to the CISA KEV catalog on 2026-09-09, due date 2026-09-23; flagged as affecting multiple Chromium-based browsers including Edge and Opera; ransomware use listed as Unknown. — CISA KEV
• EPSS score is 0.03507 (89.16th percentile) as of 2026-10-29. — FIRST EPSS