Chrome CVE-2026-87491: V8 Out-of-Bounds Write Exploited in the Wild

1. Basic Information

• Article Title: Google warns of new Chrome zero-day bug exploited in attacks
• Publisher: BleepingComputer
• Publication Date: 2026-09-09
• Original Source: BleepingComputer
• Related Sources: Chrome Releases: Stable Channel Update for Desktop
• Related Malware, Groups, CVEs, and Products: CVE-2026-87491, Google Chrome, Chromium, V8
• Priority: Critical

2. Executive Summary

Google has confirmed in-the-wild exploitation of CVE-2026-87491, an out-of-bounds write in V8, and released a fix in Chrome 153.0.8010.36/.37. A crafted HTML page can lead to arbitrary code execution inside the browser sandbox.

3. Attack Flow

Potential exploitation path based on the vulnerability description; actual delivery details are undisclosed

1. An attacker directs the user to crafted HTML or JavaScript.
2. Chrome processes the malicious script in V8, where an out-of-bounds write corrupts heap memory.
3. Successful exploitation allows arbitrary code execution inside the browser sandbox.
4. Inference: A separate sandbox escape could extend the compromise to the endpoint, but such a chain has not been confirmed for this case.

4. Attacker Position and Execution Environment

• The attacker can deliver crafted web content. The vulnerable processing occurs in V8 on the victim’s Chrome browser; this is not a server-intrusion scenario.

5. What Users and Administrators May See

Users

• Inference: A tab may crash after opening a crafted page, but exploitation may also produce no obvious symptoms.

Administrators

• Inference: Browser crash reports and detection alerts can provide leads. Neither alone establishes exploitation of this CVE or successful code execution.

6. Success Conditions and Risk Reduction

Success Conditions

• The browser is running an unpatched Chrome version.
• Chrome can process the attacker’s crafted HTML, and the exploit succeeds.

Failure Conditions and Risk Reduction

• Update Chrome to 153.0.8010.36/.37 or a later fixed release, and verify the running version after restarting.
• Identify delayed updates on managed browsers and investigate suspicious child processes or memory detections.

7. Potential Impact

• Arbitrary code execution inside the browser sandbox.
• Inference: Data available within that execution context could be exposed. Compromise of all sessions or of the whole endpoint requires separate evidence.

8. Observable Logs

Inference: These are investigation sources and their collection requirements.

• Email: If email delivered the lure, preserve message IDs, URLs, delivery records, and click records. No case-specific lure has been disclosed.
• Proxy/SWG/DNS: Review destinations, redirects, and timestamps. Visibility into HTTPS paths and content depends on collection settings such as TLS inspection.
• Endpoint/EDR: Check the running Chrome version, crashes, memory detections, and suspicious child processes. Code execution inside the browser does not necessarily spawn a child process.
• Identity/IdP: Investigate subsequent sign-ins and session use for affected users. Browsing alone does not establish an identity compromise.
• SaaS/Cloud: Use browser-management records to verify updates and restarts. Extend to SaaS audit records if follow-on activity is suspected.
• Network: Correlate outbound connections by endpoint and time. Network metadata alone cannot prove V8 memory corruption.

9. Assessing Attack Success

The following are evidence criteria for an individual investigation, not claims that each stage occurred. See Facts and Unknowns for the reported scope.

• Attempt observed (success unconfirmed): Evidence criterion: Confirm contact with crafted content. A connection to a URL alone does not establish exploitation.
• User interaction confirmed: Evidence criterion: Confirm that the user viewed the relevant page. Opening a page and executing attacker code are separate events.
• Initial execution confirmed: Evidence criterion: Require evidence of attacker-controlled code execution inside the browser. A crash alone is insufficient.
• Malware execution or authentication success confirmed: Evidence criterion: Separately confirm additional payload execution or an unauthorized sign-in. Do not infer SYSTEM privileges from this CVE alone.
• Data theft or session compromise confirmed: Evidence criterion: Confirm attacker access to protected data, exfiltration, or unauthorized use of a session.
• Follow-on compromise confirmed: Evidence criterion: Require evidence of additional compromise, such as execution outside the sandbox or persistence. The actual attack chain remains undisclosed.

10. Investigation Playbook

Inference: Operational recommendations based on the described behavior.

• Trigger: Suspicious browsing on an unpatched Chrome installation coinciding with a crash or memory detection.
• Initial Checks: Preserve the running version, restart status, browsing time, and URL.
• Endpoint: Check the running Chrome version, crashes, memory detections, and suspicious child processes. Code execution inside the browser does not necessarily spawn a child process.
• Identity and Cloud: Investigate subsequent sign-ins and session use for affected users. Browsing alone does not establish an identity compromise. Use browser-management records to verify updates and restarts. Extend to SaaS audit records if follow-on activity is suspected.
• Follow-on Activity: Require evidence of additional compromise, such as execution outside the sandbox or persistence. The actual attack chain remains undisclosed.
• Containment: Update and restart Chrome. Isolate endpoints with evidence of compromise, preserve evidence, and revoke affected sessions.
• Classification: Distinguish contact, execution, abuse of privileges, data collection, and follow-on compromise using evidence. Missing logs do not prove that compromise did not occur.

11. Defense and Detection Ideas

Inference: Operational recommendations based on the described behavior.

• Single Event: Suspicious browsing on an unpatched Chrome installation coinciding with a crash or memory detection.
• Time-Series Correlation: Link browsing, browser anomalies or execution evidence, outbound traffic, and subsequent identity use by endpoint, user, and time.
• Threat Hunting: Start with unpatched endpoints and investigate overlaps between browsing history, crashes, and execution detections.
• Logging Gaps: Check the running Chrome version, crashes, memory detections, and suspicious child processes. Code execution inside the browser does not necessarily spawn a child process. Correlate outbound connections by endpoint and time. Network metadata alone cannot prove V8 memory corruption.
• Priority Controls: Update Chrome to 153.0.8010.36/.37 or a later fixed release, and verify the running version after restarting. Identify delayed updates on managed browsers and investigate suspicious child processes or memory detections.

12. Facts / Inference / Hypothesis

Facts

• Google states that an exploit for CVE-2026-87491 exists in the wild.
• Google’s CVE description identifies a V8 out-of-bounds write that allows arbitrary code execution inside the sandbox through crafted HTML.
• The fixed releases are 153.0.8010.36 for Linux and 153.0.8010.36/.37 for Windows and macOS.
• The actors, targets, delivery path, and involvement of a sandbox escape have not been disclosed.
• Google rates the vulnerability Medium. This report’s Critical priority reflects the need to respond to active exploitation and is distinct from the vendor’s severity rating.

Inference

• The investigation, success-assessment, and defense recommendations are derived from public information. They are not observations of real-world compromise.

Hypothesis

No additional hypotheses. Unresolved points are listed under Unknowns and Further Investigation.

13. MITRE ATT&CK Mapping

• T1203 Exploitation for Client Execution (high confidence): Exploitation of the out-of-bounds write in V8.

14. Unknowns and Further Investigation

• The campaign, targets, delivery path, and exploit samples.
• Any chain involving a sandbox escape or another zero-day vulnerability.

15. Impact on SOCs and Organizations

An automatic-update policy is not proof that the running browser has been patched. Verify the active version and restart status through endpoint inventory. Where crashes or suspicious child processes are present, investigate credential and session use after the browsing event.

16. Audience Summaries

• SOC: Link browsing, browser anomalies or execution evidence, outbound traffic, and subsequent identity use by endpoint, user, and time.
• Administrators: Update and restart Chrome. Isolate endpoints with evidence of compromise, preserve evidence, and revoke affected sessions.
• Users: Update and restart Chrome as instructed by your administrator, and report suspicious pages or crashes.