Advisory · CVE-2026-87491
Chrome zero-day runs attacker's code inside the browser sandbox
An out-of-bounds write in Chrome's V8 engine lets a remote attacker run code inside the browser sandbox via a crafted page. Fixed in Chrome 153.0.8010.36; Google confirms an exploit exists in the wild.
- Vendor
- Product
- Chrome
- Identifier / CWE
- CVE-2026-87491
CWE-787 - Action timing
- Sep 30, 2026
Explain it like I’m five
A web page is like a letter, and the browser reads it inside a padded room so a nasty letter cannot hurt anyone. This flaw lets a booby-trapped letter smash the furniture inside the padded room, which is the first step toward breaking out of it.
- 01Crafted page
The attacker lures the victim to a web page containing malicious JavaScript or WebAssembly content.
- 02V8 memory bug
The page triggers an out-of-bounds write in V8, Chrome's JavaScript and WebAssembly engine.
- 03Sandbox code runs
The memory corruption lets the attacker execute arbitrary code inside Chrome's sandbox.
- 04Foothold gained
The attacker now has code running on the victim's machine, one step away from a sandbox escape.
What happened
Google’s September 8, 2026 stable channel update fixed 230 vulnerabilities, including CVE-2026-87491, an out-of-bounds write (CWE-787) in V8, Chrome’s JavaScript and WebAssembly engine. The flaw affects Google Chrome prior to 153.0.8010.36 and allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Google states it is aware that an exploit for CVE-2026-87491 exists in the wild. The vulnerability was reported on August 6, 2026 by Jihyeon Jeong of Seoul National University. This is the seventh actively exploited Chrome zero-day Google has patched in 2026. The fix shipped in Chrome 153.0.8010.36 and .37 for Windows and macOS, and 153.0.8010.36 for Linux. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 9, 2026.
What to do
- Update Chrome to 153.0.8010.36/.37 or later on all platforms and restart the browser so the update takes effect.
- Verify patch deployment across the fleet rather than assuming auto-update completed, and check other Chromium-based browsers (Edge, Electron apps) for vendor fixes incorporating the V8 change.
- Investigate suspicious browser activity on endpoints that were running vulnerable versions during the exposure window.
- Treat sandbox code execution as a likely precursor to a sandbox-escape attempt: pair this update with review of endpoint detection alerts from the same period.
Management note
Browser zero-days are the front door of most endpoint compromises, and this one was already being exploited before the fix shipped. Chrome usually updates itself, but staged rollouts and managed fleets can lag for days, which is exactly the window attackers use. Confirming the update actually landed everywhere matters more than the update existing.