CVE-2026-87491: Chromium V8 Out-of-Bounds Write Enables Sandboxed Remote Code Execution via Crafted HTML

Background

V8 is Google’s open-source JavaScript and WebAssembly engine, embedded in every Chromium-based browser — including Google Chrome, Microsoft Edge, Opera, Brave, and numerous other derivatives. Because V8 executes untrusted JavaScript from essentially every website a user visits, it is one of the most heavily scrutinized and actively targeted pieces of software in the browser security landscape, and V8 memory-safety bugs are a recurring entry on CISA’s KEV catalog (this same dataset includes several prior Chromium V8 entries, including CVE-2026-11645 and CVE-2026-3910).

CVE-2026-87491 is an out-of-bounds write vulnerability in V8 that allows a remote attacker to execute arbitrary code inside the Chromium sandbox simply by getting a victim to load a crafted HTML page — no further user interaction such as a click or download is required beyond page load. Because V8 ships identically across all Chromium-based browsers, this single vulnerability has an unusually wide blast radius across the browser ecosystem.

Technical Mechanism

CVE-2026-87491 is classified under CWE-787 (Out-of-Bounds Write). In a JavaScript engine like V8, out-of-bounds write bugs typically arise from incorrect bounds-checking logic in the engine’s handling of typed arrays, array buffers, or internal object representations — often introduced or exposed by V8’s Just-In-Time (JIT) compiler, TurboFan, when it optimizes code paths based on incorrect assumptions about object shape or array length.

A representative exploitation flow for this vulnerability class:

1. An attacker hosts or injects a crafted HTML page containing JavaScript specifically engineered to trigger the vulnerable code path in V8 — commonly by manipulating an array or typed-array object in a way that causes the engine’s optimizing compiler to make an incorrect assumption about the object’s bounds.
2. The victim’s browser loads the page and executes the embedded JavaScript as part of normal page rendering — no click, download, or explicit user consent beyond navigating to the page is required.
3. The crafted script triggers the out-of-bounds write, corrupting adjacent heap memory within the V8 renderer process. Attackers commonly use this primitive to corrupt object metadata (such as a fake object’s length or type field) to gain broader read/write control over the heap.
4. With sufficient heap control, the attacker can hijack control flow within the renderer process, achieving arbitrary code execution — but constrained to the Chromium sandbox, meaning the attacker’s code runs inside the heavily restricted renderer process sandbox rather than with full operating system privileges.

Because browser renderer processes are sandboxed by design, a V8 RCE bug alone typically does not grant the attacker system-level access — it is frequently paired in real-world attack chains with a separate sandbox-escape vulnerability to break out of the renderer sandbox into the broader OS. The provided KEV data does not indicate whether CVE-2026-87491 has been observed chained with a sandbox-escape bug in the wild.

Real-World Exploitation Evidence

CISA added CVE-2026-87491 to the Known Exploited Vulnerabilities catalog on 9 September 2026, confirming — by the nature of KEV listing — that active exploitation in the wild has been observed or credibly reported, not merely demonstrated in a research/lab setting.

No specific threat actor, campaign name, or intrusion set is included in the available KEV record for this entry. No specific threat actor has been publicly attributed to exploitation of this CVE; its KEV listing confirms active exploitation in the wild, but attribution detail is not yet public. V8 zero-days of this nature have historically been used by commercial spyware vendors and nation-state actors in watering-hole and targeted spear-phishing campaigns against journalists, dissidents, and government personnel, given the cost and sophistication typically required to develop a reliable renderer-process exploit — but that association is not confirmed for this specific CVE absent public attribution.

The knownRansomwareCampaignUse field for this entry is marked “Unknown” — CISA has not confirmed ransomware use of this CVE at this time, which is consistent with the typical use case for browser renderer exploits (initial access and targeted intrusion rather than ransomware deployment).

Impact Assessment

A remote, zero-click (beyond page load) code execution vulnerability in a universally deployed browser engine carries severe impact:

• Confidentiality: Code execution inside the renderer sandbox gives an attacker access to whatever the renderer process can read — including the content of the page being rendered, and potentially session data or credentials cached within the browser context, depending on what else runs in the same process.
• Integrity: An attacker can manipulate page content, inject further malicious scripts, or use the renderer compromise as a staging point for a sandbox-escape attempt targeting the browser’s privileged broker process or the underlying OS.
• Availability: Exploitation attempts that fail to achieve clean code execution commonly crash the renderer process (visible to the user as a “page crashed” tab), which can itself be used for denial-of-service harassment at scale.
• Scale of exposure: Because V8 is shared across Chrome, Edge, Opera, Brave, and other Chromium derivatives, this vulnerability affects a substantial share of the global browser install base simultaneously — a single exploit chain can be reused across multiple “different” browsers.

Sector-specific risk: Because browsers are universally deployed, the most relevant risk framing here is user role rather than industry sector: high-value individuals (executives, government officials, journalists, activists) are disproportionately likely to be targeted with sophisticated renderer exploit chains, while the broader population faces risk primarily from this bug being incorporated into more opportunistic exploit kits once technical details become more widely known.

Affected Versions

Google’s Chrome stable channel release notes (linked below) are the authoritative source for the exact affected version range. Organizations should consult it directly, and this guidance extends to other Chromium-based browsers (Edge, Opera, Brave, Vivaldi, etc.), which typically ship fixes shortly after upstream Chromium patches land.

Remediation Steps

CISA’s required action directs organizations to apply vendor mitigations per BOD 26-04 guidance and follow Forensics Triage Requirements, or discontinue use of the product if mitigations are unavailable.

1. Update Chrome (or your Chromium-based browser) to the latest stable version immediately. Chrome typically auto-updates, but verify:

chrome://settings/help

This page displays the current version and triggers an update check if one hasn’t already completed.

2. For enterprise-managed fleets, push the update via your endpoint management platform (Google Workspace browser management, Microsoft Intune for Edge, etc.) rather than relying solely on individual auto-update, to ensure consistent and verifiable patch compliance.

3. Restart the browser after updating — V8 and renderer process fixes do not take effect for already-open browser instances until a full restart.

4. Audit and update all Chromium-based browsers in the environment, not just the organization’s standard browser — Edge, Opera, and other derivatives installed incidentally (e.g., bundled with other software) are equally exposed and easily overlooked.

5. Consider Site Isolation and sandboxing hardening settings already enabled by default in modern Chromium builds as a defense-in-depth measure, though these do not substitute for prompt patching.

Detection Guidance

Exact IOCs for this specific exploit chain have not been publicly disclosed, consistent with Google’s practice of withholding technical detail on actively exploited V8 bugs. General detection approaches:

• Browser crash telemetry: Enterprises with endpoint monitoring should review for anomalous renderer process crash patterns correlated with visits to specific, unusual domains — a possible indicator of failed exploitation attempts.
• Endpoint detection (EDR): Monitor for anomalous child processes spawned from the browser renderer process after visiting untrusted sites — a potential sign of successful sandbox escape following initial V8 exploitation (though this bug alone is sandbox-confined).
• Network/proxy logs: Review for connections to newly registered or low-reputation domains immediately preceding anomalous browser behavior, consistent with watering-hole delivery patterns typical of this exploit class.
• Patch compliance as primary control: Given the lack of public technical detail, maintaining current patch levels across the fleet is the most reliable control available; treat any browser instance running a pre-patch build as a live exposure requiring urgent remediation.

Timeline

References

• Chrome Releases — Stable Channel Update for Desktop
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk
• CISA — BOD 26-04 Implementation Guidance: Forensics Triage Requirements
• NVD — CVE-2026-87491