CVE-2026-87491 is an actively exploited flaw in V8, Google’s engine for running JavaScript and WebAssembly. In the browser case, that makes the attack surface unusually ordinary: a user need only load an attacker-crafted HTML page. The attacker needs no account or prior access, but does need that interaction; the disclosed outcome is arbitrary code execution inside the browser sandbox, not a confirmed escape from it.
V8 powers Chrome’s web content and is also used in other software, but the published affected-product description is specifically Chrome in a browser context. That matters for the people operating it: centrally managed Chrome fleets on employee endpoints are common across businesses, government, education, healthcare and any organisation issuing browsers to staff. CISA also says Chromium-based browsers including Edge and Opera could be affected, so this is an inventory problem for every organisation running Chrome-derived browsers, not just a Chrome desktop patching task.
A property lookup broke a no-side-effects assumption
The bug is an out-of-bounds write: code writes beyond the intended limits of a memory region. In V8’s WebAssembly property handling, a path expected to have no side effects could call a JavaScript getter while retrieving a property. That unexpected execution disrupted the assumptions around the operation and opened the route to memory corruption, which an exploit can turn into code execution in the renderer sandbox.
Google’s published V8 fix changes the lookup to inspect property metadata and accept only a data property, rather than invoking an accessor. It is a useful reminder that “own property” checks do not automatically make a later property read side-effect free in a language with getters.
Google rates the Chromium issue Medium, while CISA’s enrichment assigns CVSS 3.1 8.8 High; those are different scoring assessments, not competing facts. Google confirmed an exploit exists in the wild, but has not identified victims, targets, delivery method, actor or the rest of the exploit chain. There is no confirmation that attacks escaped the sandbox.
Patch Chrome now; verify every Chromium derivative
Chrome versions before 153.0.8010.36 are affected. Google released 153.0.8010.36 for Linux and Android, and 153.0.8010.36 or 153.0.8010.37 for Windows and macOS. Teams should force or accelerate browser updates, confirm installed versions through endpoint management, restart browsers where their update process requires it, and prioritise devices that browse untrusted sites or handle sensitive sessions.
The issue is CISA KEV-listed, added September 9 with a September 23 remediation due date. CISA records ransomware use as Unknown. No standalone public weaponized exploit or ordinary crafted-HTML proof of concept could be confirmed. Google’s public patch does include a regression reproducer using internal V8 testing flags, but that is not a reusable browser exploit page.
For Edge, Opera, Brave, Vivaldi and other downstream browsers, fixed release numbers could not be confirmed. Do not assume that Chrome’s version proves those products are remediated: obtain vendor guidance, update as soon as a relevant build is available, and temporarily reduce exposure where updates lag. ChromeOS, Chrome Extended Stable, Node.js and other V8 embedders likewise have no confirmed product-specific status here.
This is one of those browser bugs where user browsing is the initial foothold and rapid fleet hygiene is the practical control. SecAlerts monitors an organisation’s actual software stack and alerts on new vulnerabilities affecting the products it runs, which is especially useful when one engine appears beneath several browser brands.
