CVE-2026-87491 — Google Chromium V8: Google Chromium V8 Out of Bounds Write Vulnerability

1. Executive summary

CVE-2026-87491 is an out-of-bounds write vulnerability (CWE-787) in Google Chromium V8, rated CVSS 8.8 HIGH, allowing a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. It is not currently listed in CISA's Known Exploited Vulnerabilities catalogue and carries an EPSS score of 0%, indicating no observed exploitation at time of writing. The affected component is shared across Chromium-based browsers — Google Chrome, Microsoft Edge and Opera are named in the advisory — so exposure extends beyond a single vendor's build. For EMEA financial services, the practical risk is drive-by compromise of workstations via a malicious or compromised web page, with the browser process as the initial foothold. The advisory sets a remediation due date of 2026-09-23.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The trigger test fails: this is a pre-exploitation patching advisory with no incident, no confirmed threat actor, and no third-party provider relationship beyond routine vendor patching — facts that would be true of virtually any security update.

3. Technical analysis & attack chain

Vulnerability mechanism. CWE-787 out-of-bounds write in the V8 JavaScript/WASM engine. A crafted HTML page causes V8 to write beyond the bounds of an allocated memory region, giving the attacker control over adjacent heap or object memory. The confirmed impact is arbitrary code execution inside the sandbox — the source does not describe a sandbox escape, so post-exploitation reach is constrained to the renderer process unless chained with a separate escape primitive.

Confirmed attack chain (as far as the source supports)

1. Victim visits a crafted HTML page in a Chromium-based browser (Chrome, Edge, Opera named).
2. The page's JavaScript reaches the vulnerable V8 code path and triggers the out-of-bounds write.
3. Memory corruption yields arbitrary code execution within the renderer sandbox.

Steps beyond this — C2, persistence, lateral movement, data exfiltration — are not described in the source material and should not be assumed. Known ransomware campaign use is recorded as Unknown.

Corpus context. Two other Chromium V8 flaws appear in the corpus as CISA KEV entries — CVE-2026-11645 (out-of-bounds read and write, due 2026-06-23) and CVE-2026-85046 (type confusion, due 2026-09-18). These are separate vulnerabilities; their KEV status does not transfer to CVE-2026-87491, which remains unlisted. Their presence does, however, indicate active exploitation pressure against the same component this quarter.

Confidence caveat. The vulnerability description is single-sourced to the NVD entry; no vendor blog, exploit write-up or threat report corroborates the mechanism or any in-the-wild use. EPSS 0% and the absence from KEV are consistent with no observed exploitation, but absence of evidence is not evidence of a non-exploited state for a browser bug of this class.

4. Mitigation & containment

P1 — within 24 hours

• Inventory all Chromium-based browsers in the estate — Chrome, Edge, Opera at minimum; include any Electron or embedded-Chromium applications where feasible, though the advisory scope is browsers.
• Check vendor channels for the fixed Chrome/Edge/Opera builds. The fixed version for this CVE is not stated in the source; treat any build released on or after the advisory date as the target and confirm against the vendor's release notes.
• If a fixed build is available, deploy via existing patch management and force a browser relaunch — Chromium updates apply on restart.

P2 — within 72 hours

• Complete patching of internet-facing and user-workstation fleets ahead of the 2026-09-23 due date.
• Where patching is not yet possible, apply interim controls: enforce site isolation (enabled by default in current Chrome/Edge, verify it has not been disabled), and restrict browsing on high-value workstations to allow-listed domains where the risk appetite supports it.
• Verify EDR coverage on endpoints with browser telemetry, since renderer-process code execution is the expected post-exploitation signature.

P3 — within 7 days

• Confirm patch compliance across the full estate and close out against the 2026-09-23 due date.
• Review browser update policy: ensure auto-update is not disabled by group policy or third-party management tooling, a common gap that delays Chromium patching.
• Fold the related KEV-listed V8 issues (CVE-2026-11645, CVE-2026-85046) into the same patch verification pass if not already closed.

5. Indicators of compromise

No indicators of compromise available in the source material.

6. Detection

Insufficient indicators to author detection rules.

CVE assessment

1 referenced CVE

7. Sources

• NVD, CVE-2026-87491 — Google Chromium V8: Google Chromium V8 Out of Bounds Write Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2026-87491, published 2026-09-08
• NVD, CVE-2026-11645 — Google Chromium V8: Google Chromium V8 Out-of-Bounds Read and Write Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2026-11645
• NVD, CVE-2026-85046 — Google Chromium V8: Google Chromium V8 Type Confusion Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2026-85046
• GitHub Security Advisories, Out of bounds write in V8 in Google Chrome prior to 151.0.7922.109, https://github.com/advisories/GHSA-xc4c-849c-886m
• GitHub Security Advisories, Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216, https://github.com/advisories/GHSA-r89w-9xc7-23rc
• GitHub Security Advisories, Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128, https://github.com/advisories/GHSA-wwqm-cwjr-9577
• GitHub Security Advisories, Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109, https://github.com/advisories/GHSA-rf7w-2xrf-qfwr

8. Adverse Trace position

CVE-2026-87491 is a high-severity (CVSS 8.8) memory-corruption flaw in a component running on effectively every EMEA financial services desktop, but the verified data shows no KEV listing and 0% EPSS — we treat it as a priority patch, not an active threat, and we are not advising emergency action beyond the standard P1 inventory-and-patch cycle. The single-sourced description and the absence of a stated fixed version are the two gaps to close: clients should confirm the patched build against vendor release notes rather than assuming currency from version numbers cited for other V8 CVEs. The pattern of repeated V8 out-of-bounds writes and two KEV-listed V8 flaws in the same quarter is the more useful signal — it argues for tightening Chromium update SLAs rather than treating each CVE in isolation. We will monitor for KEV addition or EPSS movement and reissue this advisory if exploitation is observed.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.