SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
4 SOURCES ON THIS EVENT
▲ ACT NOWCVE-2026-87491 · CVSS 8.8

Google Chromium V8: attackers can run their own code

AFFECTSGoogle Chromium V8

OFFICIAL NAME: Google Chromium V8 Out of Bounds Write Vulnerability

WHAT IT IS · COMPUTERS, PHONES AND BROWSERSIt runs on staff computers, phones or browsers.

DO THIS FIRSTInstall the latest updates on every device, and turn on automatic updates. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

WHY THIS VERDICT Attacks are confirmed. The vulnerability is 60 days old, so many systems are likely still unpatched.

WHY IT RANKS HERE Exploitation is confirmed by an authoritative source.

HIGHEST CONFIRMED RUNG
EXPLOITED
CISA KEV
LISTED
EXPLOIT CODE
PROOF OF CONCEPT CLAIMED
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    ▨ REPORTED, NOT CONFIRMED
    NEWEST EVIDENCE · 1 SOURCE

    CVE-2026-87491 discussed publicly (CIRCL sighting).

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Attacks that worked are confirmed (step 4), so attempts count as confirmed too.

  4. 04 EXPLOITED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    CISA Vulnrichment marks CVE-2026-87491 as actively exploited. Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2026-87491 published
  2. EXPLOIT CODE PUBLIC
    CLAIMED
  3. FIRST ATTACK REPORT
    CISA Known Exploited Vulnerabilities
  4. CISA KEV LISTING
    CISA KEV listing
  5. US FEDERAL DEADLINE
    CISA deadline for US federal agencies
Attacks were reported on or before the day the flaw was disclosed.

THE FIX

CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. The deadline CISA set for US federal agencies, Sep 23, 2026, has passed. It is a US government deadline; use it as a guide.

// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. Attack activity. SEP 8, 2026
    Google Chromium V8 Out of Bounds Write Vulnerability
  2. Attack activity. SEP 8, 2026
    CISA Vulnrichment marks CVE-2026-87491 as actively exploited
  3. SEP 10, 2026
    1 public GitHub repository claims a proof of concept for CVE-2026-87491
  4. NOV 3, 2026
    CVE-2026-87491 discussed publicly (CIRCL sighting)

SOURCES

  1. [1] CIRCL Vulnerability-Lookup sightings: CVE-2026-87491 discussed publicly (CIRCL sighting), NOV 3
  2. [2] PoC-in-GitHub: 1 public GitHub repository claims a proof of concept for CVE-2026-87491, SEP 10
  3. [3] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-87491 as actively exploited, SEP 8
  4. [4] CISA Known Exploited Vulnerabilities: Google Chromium V8 Out of Bounds Write Vulnerability, SEP 8