CVE-2026-87491

This is a mistake in Chrome’s internal JavaScript engine (V8) where a malicious web page can push Chrome to write outside the expected memory area. In real attacks, that can let an attacker run code in the browser’s sandbox while a user just visits a specially crafted page. It’s like a lock with a dangerous weak spot: even if it’s “contained,” attackers may still use it to steal what they can from your session or disrupt work.

This matters if your business runs Google Chrome on any computers where employees or customers browse the web. Because it’s already on CISA’s KEV list, treat it as a real, actively abused browser vulnerability. It’s only a risk when a device can reach the internet and can load attacker-controlled web content in Chrome (for example, users visiting a malicious page).

This is RED because CISA added CVE-2026-87491 to the KEV list, meaning it has been confirmed exploited in the real world. Attackers are already using crafted HTML pages to trigger the V8 out-of-bounds write, so delay increases exposure of any device running an unpatched Chrome version.

1. Identify affected devices and current Chrome versions

   • On each device: open Chrome → Settings → About Chrome (or equivalent) to record the version.
   • Mark any device running Google Chrome prior to 153.0.8010.36.

2. Confirm fix readiness

   • Ensure you can update Chrome on managed endpoints (MDM/GPO/software deployment), and for unmanaged devices confirm users can update or that you provide the update method.

3. Upgrade to the fixed version

   • Update Google Chrome to 153.0.8010.36 or later (the vendor’s fixed stable channel).
   • After updating, fully restart Chrome to ensure the new engine is active.

4. Validate patch completion

   • Re-check About Chrome on each updated device and confirm the installed version is 153.0.8010.36 or newer.
   • If your environment has multiple Chrome channels (e.g., stable vs. other), confirm you are updating the channel actually in use.

5. If you cannot patch immediately (temporary containment)

   • Reduce exposure by restricting or blocking access to untrusted/malicious sites via your web filtering/SWG, and enforce browser update policies where possible.
   • Consider tightening policies that prevent users from installing software or changing browser settings, so the update can be completed quickly.
   • This is a stopgap only; the real fix is upgrading to 153.0.8010.36+.

6. CISA due date and follow-up

   • CISA KEV remediation due date is 2026-09-23. Prioritize affected devices before this date.

7. What to monitor

   • After patching: look for unusual browser-related activity on endpoints (unexpected downloads, new persistence mechanisms, or repeated alerts from your endpoint security tools). If your tools support it, prioritize alerts that correlate with the time window before patching.

Severity and type: This is an exploited memory safety bug (CWE-787: out-of-bounds write) in Google Chrome’s V8 JavaScript engine. Attack vector/mechanism: a remote attacker can use a crafted HTML page to trigger the out-of-bounds write and achieve arbitrary code execution inside the browser sandbox. Exposure conditions: no public exploit code was found in the provided findings, but exploitation is confirmed via CISA KEV (added 2026-09-09). Exploit maturity: confirmed in the wild (KEV), no public exploit code on record. Fix: Google Chrome is fixed in 153.0.8010.36. KEV meaning here: CISA KEV indicates the vulnerability is known to be exploited in real-world attacks, so patching/mitigation is required rather than treated as theoretical. EPSS: provided as a prediction (not used for urgency because KEV exploitation confirmation takes precedence).