Chrome V8 RCE exploited in the wild (CVE-2026-87491)

Actively exploited in the wild - CVE-2026-87491 is a high-severity out-of-bounds write in Google Chrome’s V8 JavaScript engine, affecting versions prior to 153.0.8010.36, that lets a remote attacker execute arbitrary code inside the browser sandbox via a crafted HTML page. Patched in Chrome 153.0.8010.36; update immediately.

Overview

CVE-2026-87491 is a memory corruption bug in V8, the component that compiles and runs JavaScript inside Chrome. An out-of-bounds write means the engine can be tricked into writing data past the end of an allocated buffer. When an attacker controls that write, they can overwrite adjacent memory and redirect execution flow. Because the trigger is a crafted HTML page, no user credentials or special access are needed: the victim only has to load the page.

The Chromium project rates the issue Medium, but the CVSS score is 8.8 (HIGH) because the attack is remote, requires no privileges, and needs only normal browsing activity. CISA has added CVE-2026-87491 to its Known Exploited Vulnerabilities catalog, confirming that threat actors are using it in real campaigns rather than proof-of-concept code. EPSS currently puts 30-day exploitation probability at roughly 0.3%, a low figure that reflects how hard the bug is to weaponize reliably; the KEV listing and confirmed in-the-wild use matter far more to defenders than the statistical estimate.

Impact

A successful exploit gives the attacker code execution inside the sandbox that isolates Chrome from the rest of the machine. That is not full system compromise on its own, but it is a serious foothold. From there, an attacker can attempt a sandbox escape, steal data the browser can reach, or pivot into enterprise web applications that trust the browser session. Affected systems are any desktop or mobile endpoint running Chrome earlier than 153.0.8010.36, plus downstream browsers that ship the same V8 engine, including Microsoft Edge, Brave, Opera, and other Chromium derivatives that have not yet pulled the fix.

Remediation

• Update Google Chrome to 153.0.8010.36 or later. Use the built-in updater and restart the browser so the new binary takes effect.
• Apply equivalent updates for Edge, Brave, Opera, Vivaldi, and any other Chromium-based browser in your fleet.
• Track your software inventory to confirm every endpoint has moved off the vulnerable build; unmanaged or rarely restarted machines are the common gap.
• If immediate patching is not possible, isolate high-risk browsing with a hardened or virtualized browser profile, and restrict access to untrusted sites through network controls.

Security Insight

V8 has become one of the most consistently targeted components in modern browsers, and CVE-2026-87491 follows the same pattern as Chrome V8 zero-day CVE-2026-11645 exploited in the wild: memory-safety bugs in the JavaScript engine are routinely weaponized before defenders can respond. The steady cadence of Chrome additions to the KEV catalog, covered in our CISA KEV roundup, shows that browser engines remain a preferred initial access vector. The gap is not detection technology but patch velocity on endpoints that users postpone restarting, a pattern we also flagged in the June zero-day roundup.

Further Reading

• Weekly Threat Roundup: Ivanti & Chrome Zero-Days (June 8-14)
• CISA adds Cisco, Chrome flaws to KEV catalog
• Chrome V8 zero-day CVE-2026-11645 exploited in wild
• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs