CVE-2026-87491KEV · OVERDUECWE-787

Google Chromium V8 Out of Bounds Write Vulnerability

High · published September 9, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 87.8th percentile for exploit probability.

31
days past CISA
deadline
CVSS v3.1
8.8
EPSS
3%
Percentile
87.8
In the wild
Confirmed
What it is

Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03142 · 87.8th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2026-09-09T05:17Z
KEV added
2026-09-09 · due 2026-09-23
Affected products (1)
ProductVersionsFixed in
google/chrome< 153.0.8010.36153.0.8010.36
References (3)
https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html · [email protected]https://issues.chromium.org/issues/543557673 · [email protected]https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87491 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 09 SEP 00:09Z
    Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML…
    cvelistv5