Vulnerability report

Exploitation attempts observed in the wild Confirmed confidence In CISA KEV

CVE-2026-87491

Chrome

Google / Chrome · affected before 153.0.8010.36

Watch CVE-2026-87491 Browse KEV feed
Severity
CVSS 8.8 · High
Confidence
Confirmed
Exploit status
Exploitation attempts observed in the wild
EPSS
3.1%
First observed
—
Last observed
—

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-87491 is an unauthenticated vulnerability affecting Google Chrome. Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via...

Have exploitation attempts been observed?

Yes. Exploitation attempts have been reported for this vulnerability. Previdian lists it as a known exploited vulnerability. Listed in CISA KEV. Also reported by third-party sources. Confidence is confirmed.

Who is affected?

Google / Chrome affected before 153.0.8010.36.

What should we do?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Overview

Chrome

Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Google Affected
Chrome
Before 153.0.8010.36
Published
09 Sep 2026
Exploitation Attempts Reported
09 Sep 2026
Attack vector
Remote
Complexity
Low
Privileges
None
User interaction
Required

Tags

cisa

CVE References

Exploitation evidence

Evidence of exploitation attempts

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploitation attempts observed in the wild

CyberInsider

Recorded 09 Sep 2026

A trusted third party reported exploitation attempts.

Proof of concept available

GitHub

Recorded 10 Sep 2026

Public scanner or PoC coverage increases practical exploitability.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access
Source Added
CyberInsider First 2026-09-09 08:00 UTC
The Hacker News 2026-09-09 09:11 UTC
CISA 2026-09-09 19:20 UTC
CVE 2026-09-09 20:01 UTC
Qualys ThreatPROTECT 2026-09-10 05:14 UTC

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets
User-Agents
Callback hosts
0
0
0

Request targets and User-Agents available in Pro. Callback host details available in Enterprise.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

No detection artifacts or sensor request patterns are available for this CVE yet.

Check back as sensor telemetry and scanner integrations are updated.

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

8.8 High

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

3.1%

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Out-of-bounds Write CWE-787

Recent mention · Palo Alto Networks Security Advisories

PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026) (Severity: HIGH)

Read full advisory

All Mentions

Recent mention · Palo Alto Networks Security Advisories

PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026) (Severity: HIGH)

Palo Alto Networks Security Advisories · 14 Oct 2026

Recent mention · The Hacker News

Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

The Hacker News · 23 Sep 2026

Ravie LakshmananSep 23, 2026Zero-Day / Vulnerability A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites. The attacks, detected on September 3 and 4, 2026, involved the chaining of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one impacting Windows Advanced Local Procedure Call (CVE-2026-85880) to break out of the browser's sandbox and achieve remote code execution. "UTA0565 masqueraded as various entities including media organizations and a...

Recent mention · TheRegister

Google Pixel phones pwned in zero-click attacks

TheRegister · 16 Sep 2026

CISA gives federal agencies just 3 days to patch

Recent mention · The Hacker News

China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

The Hacker News · 15 Sep 2026

A Chinese threat actor has been attributed to a spear-phishing campaign that exploits recently patched security flaws in Google Chrome and Microsoft Windows to deliver a malicious JavaScript backdoor called GRIMWEDGE. Volexity, which is tracking the threat cluster under the moniker UTA0560, said the activity targeted multiple non-governmental organizations (NGOs) on September 1, 2026. "The

Recent mention · Qualys ThreatPROTECT

Google Chrome Zero-day Vulnerability Exploited in the Wild (CVE-2026-87491)

Qualys ThreatPROTECT · 10 Sep 2026

Google released security updates to address 230 vulnerabilities impacting the Chrome browser. One of these vulnerabilities, tracked as CVE-2026-87491, is being exploited in the wild. This is an out-of-bounds write vulnerability in the V8 JavaScript engine. The vulnerability was discovered and reported by Jihyeon Jeong (Compsec Lab, Seoul National University /Research Intern). CISA acknowledged the … Continue reading "Google Chrome Zero-day Vulnerability Exploited in the Wild (CVE-2026-87491)"

Recent mention · NCSC Security Advisories

NCSC-2026-0354 [1.00] [M/H] Kwetsbaarheid verholpen in Google Chrome

NCSC Security Advisories · 09 Sep 2026

Google heeft een zeroday-kwetsbaarheid verholpen in de V8 JavaScript engine van Google Chrome. Google meldt dat de kwetsbaarheid met kenmerk CVE-2026-87491 actief wordt misbruikt. Het betreft een out-of-bounds write in de V8-engine van Google Chrome, die voorkomt in versies vóór 153.0.8010.36. Een kwaadwillende kan een speciaal vervaardigde HTML-pagina gebruiken om de kwetsbaarheid te activeren en binnen de sandbox willekeurige code uit te voeren. De kwetsbaarheid wordt veroorzaakt door onjuiste bounds checking in het geheugenbeheer van V8, wat kan leiden tot geheugenbeschadiging. Succesvol...

Recent mention · The Hacker News

Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox

The Hacker News · 09 Sep 2026

Google on Thursday released updates to patch 230 security vulnerabilities, including one that has come under active exploitation in the wild. The medium-severity vulnerability, assigned the CVE identifier CVE-2026-87491 (CVSS score: N/A), has been described as an out-of-bounds bug in V8, Chrome's JavaScript and WebAssembly engine. "Out-of-bounds write in V8 in Google Chrome prior to

Recent mention · CyberInsider

Google fixes second actively exploited Chrome zero-day in under five days

CyberInsider · 09 Sep 2026

Google has released Chrome 153 to the stable channel with fixes for 230 security vulnerabilities, including a V8 memory corruption flaw that Google says is already being exploited in attacks. The actively exploited vulnerability is tracked as CVE-2026-87491 and is described as an out-of-bounds write in V8, Chrome’s JavaScript and WebAssembly engine. It was reported … The post Google fixes second actively exploited Chrome zero-day in under five days appeared first on CyberInsider.

Recent mention · Google Chrome Releases

Stable Channel Update for Desktop

Google Chrome Releases · 08 Sep 2026

The Chrome team is delighted to announce the promotion of Chrome 153 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks.Chrome 153.0.8010.36 (Linux) 153.0.8010.36/.37 Windows/Mac contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming Chrome and Chromium blog posts about new features and big efforts delivered in 153.Security Fixes and RewardsNote: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the...

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

SneakyNachos/CVE-2026-87491-and-CVE-2026-85046-the-bagel-fell-off-the-counter

github · Created 2026-09-10 21:47:12 UTC · 1 stars · AI assessment 85%

Timeline

From disclosure to observed exploitation attempts

  1. 21:47 UTC

    Public PoC available

    Public proof-of-concept code published

  2. 05:14 UTC

    KEV confirmed by Qualys ThreatPROTECT

    Exploitation attempts reported by an external source

  3. 20:01 UTC

    KEV confirmed by CVE

    Exploitation attempts reported by an external source

  4. 19:20 UTC

    Added to CISA KEV

    Listed in the CISA Known Exploited Vulnerabilities catalog

  5. 09:11 UTC

    KEV confirmed by The Hacker News

    Exploitation attempts reported by an external source

  6. 08:00 UTC

    Added to Previdian KEV Feed

    High-confidence, third-party report of exploitation attempts

  7. 00:09 UTC

    CVE published

    Vulnerability disclosed publicly

  8. 22:38 UTC

    CVE ID reserved

    Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs
  • Evidence confidence and provenance
  • First-party sensor telemetry
  • PoC and scanner references
  • Affected versions and enrichment
  • Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-87491

Sample API response 
{
  "cve_id": "CVE-2026-87491",
  "confidence": "Confirmed",
  "cvss_score": 8.8,
  "cvss_estimated": false,
  "epss_score": 0.03142,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}