CVE-2026-87491: Google Chromium V8 Out of Bounds Write Vulnerability
What it is
Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
What to do
Schedule the vendor fix into this week’s change window, prioritising internet-facing and business-critical systems. Confirm the fix is applied everywhere, not just where it was easy.
- Priority
- This week: Schedule into this week’s change window.
- Severity (CVSS)
- 8.8 high
- CISA assessment (SSVC)
- actively exploited; needs manual effort per target; total control of the affected system
- Exploit probability (EPSS, 30 days)
- 3.1%, higher than 87% of all CVEs
- Added to CISA KEV
- 9 September 2026
- CISA fix-by date
- 23 September 2026 (US federal agencies; a sensible deadline for everyone)
- Ransomware use
- Not known
- Weakness
- CWE-787
References
- NIST NVD entry
- CISA KEV entry
- chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_08081450
- issues.chromium.org/issues/543557673
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87491
Sources: CISA Known Exploited Vulnerabilities · FIRST Exploit Prediction Scoring System (EPSS) · NIST National Vulnerability Database · CISA Vulnrichment (SSVC), via the CVE Program. This product uses data from the NVD API but is not endorsed or certified by the NVD. Summaries are machine-written from CISA’s description; treat the vendor’s advisory as the authority for fixes.