Actively exploited · Published Sep 9, 2026 · Assigned by Chrome
CVE-2026-87491
High 8.8 Exploited
In plain English
A high-severity out-of-bounds write in Chrome from Google. Attackers are actively exploiting it in the wild (listed by CISA on September 9, 2026). The chance it is exploited in the next 30 days is estimated at 3.5% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Federal agencies must remediate by Sep 23, 2026.
Official description
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | chromium | 153.0.8010.52-1~deb12u1 | DEBIAN-CVE-2026-87491 |
| Debian:13 | chromium | 153.0.8010.47-2~deb13u1 | DEBIAN-CVE-2026-87491 |
| Debian:14 | chromium | 153.0.8010.47-1 | DEBIAN-CVE-2026-87491 |
Affected products (as reported)
Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H