CVE-2026-87491
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Sep 9, 2026
- US federal agencies must remediate it by Sep 23, 2026 (BOD 22-01)
- Attacked 1 day before the vulnerability was made public
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source: CISA KEV · Sep 21, 2026 Sep 14, 2026 Sep 9, 2026 Sep 9, 2026 Sep 9, 2026 Sep 8, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| chrome | < 153.0.8010.36 |
Related articles
Exploited Cisco ISE Flaw Leads a Wave of Attacks on Trusted Software Channels
Active exploitation of a critical Cisco ISE flaw highlights attacks through trusted software channels, Orkes, Discourse, libheif and AI plugins.
BragJack Turns Browser Extensions Into Control Channels for AI Agents
BragJack shows how a malicious Chrome extension can hijack Gemini, Comet, Edge, Opera and Claude AI agents to steal files and take actions.
Cisco ISE API Authentication Flaw Opens a Remote Path to Root Access
Cisco warns of exploited CVE-2026-76460 in ISE with CVSS 10.0 enabling unauthenticated remote root access. See affected versions, patches, mitigations.
Google Patches Pixel Modem Zero-Day Exploited in Targeted Attacks
Google patched CVE-2026-58704, a Pixel modem privilege-escalation zero-day exploited in targeted attacks and added to CISA's KEV catalog.
China-Linked Hackers Chain Chrome and Windows Zero-Days to Breach NGOs
China-linked UTA0560 and APT31 chained Chrome and Windows zero-days via spear-phishing to breach NGOs, deploying GRIMWEDGE and credential-stealing malware.
Critical ScreenConnect Flaw Fuels Worm-Like Attacks Through Active Remote Sessions
CVE-2026-84869 lets attackers execute files via active ScreenConnect sessions in worm-like attacks. Patch clients to 26.6.5.9742 now.
UNC3569 Exploited Sogou Input Method to Install GRAYRABBIT Backdoor
UNC3569 exploited Sogou Input Method's sgbiz protocol and outdated Chromium browser to execute code and deploy GRAYRABBIT backdoor via DLL sideloading.
Fortinet CVE-2025-25249 Exploited at Scale to Install PivotC2 RAT
Attackers exploit Fortinet CVE-2025-25249 RCE flaw at scale, scanning 30,000+ IPs to install PivotC2 RAT on 178 devices for tunneling and data theft.
Chrome V8 Zero-Day Exploited in Active Attacks: Update to Version 153 Now
Google fixes actively exploited Chrome V8 zero-day CVE-2026-87491 plus 229 flaws. Update to Chrome 153.0.8010.36/37 and restart now.
This product uses the NVD API but is not endorsed or certified by the NVD.