Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-87491 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-09-09 |
| Vendor | |
| Product | Chromium V8 |
| CVSS Score | 8.8 (high) |
| EPSS Score | 1.0% (percentile: 61%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-09-23 |
Vulnerability Description
Source: CISA KEV
The V8 JavaScript engine in Chromium contains an out of bounds write vulnerability. It allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
The “inside the sandbox” qualifier is important and should not be dropped: code execution is confined to the renderer process, and escaping the sandbox would require an additional vulnerability. That genuinely reduces the impact of the single bug — but does not make it unimportant, because chains combining an engine bug with a sandbox escape are the standard pattern in browser attacks.
The scope is wider than Chrome alone. CISA states explicitly that the vulnerability may affect multiple browsers built on Chromium, naming Google Chrome, Microsoft Edge and Opera among others, and noting the list is not exhaustive. An organisation that manages updates for only one browser may therefore still have vulnerable workstations.
The vector is simply visiting a page, which makes this vulnerability useful in phishing campaigns and watering-hole attacks.
Required Actions
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 (“Prioritizing Security Updates Based on Risk”) guidance and CISA’s “Forensics Triage Requirements”. For cloud services, follow the applicable BOD 26-04 guidance; if mitigations are unavailable, discontinue use of the product.
Evaluating each asset’s internet exposure and adhering to BOD 26-04 patching guidelines remain the organisation’s responsibility.
Who Is Affected?
This vulnerability affects practically every organisation — a Chromium-based browser sits on most workstations today.
In practice the task comes down to two questions. Do you enforce browser updates on all workstations, including those outside the domain and those owned by employees? And does your policy cover every installed Chromium-based browser rather than only the one deemed standard? Edge ships with Windows by default, so it is often vulnerable even where the organisation “uses Chrome”.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
