{"id":"CVE-2026-87491","title":"Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page","summary":"Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-787"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-21","sourceUpdated":"2026-09-21T13:17:11.283","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87491","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/543557673","label":"chrome-cve-admin@google.com"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87491","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87491.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-87491"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87491"}],"tags":["nvd","cve.org","in-the-wild","exploit-available","kev","csaf","vex","red-hat"],"exploited":true,"exploitAvailable":true,"ssvc":{"exploitation":"active","automatable":"no","technicalImpact":"total","timestamp":"2026-09-10T03:55:21.039385Z"},"epss":0.00997,"epssPercentile":0.60708,"kev":true,"kevDateAdded":"2026-09-09","kevDueDate":"2026-09-23","kevRansomware":false,"exploits":{"github":1,"githubRepos":["https://github.com/SneakyNachos/CVE-2026-87491-and-CVE-2026-85046-the-bagel-fell-off-the-counter"],"checkedAt":"2026-09-21T13:37:57.313Z"},"zeroDay":true,"ingestedAt":"2026-09-09T01:17:17.511Z","slug":"CVE-2026-87491","body":"## Overview\n\nOut of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-87491.json)","depth":"abyssal","depthScore":74,"depthScoreParts":{"impact":48.4,"likelihood":0.2,"exploitation":25,"ransomware":0},"changes":[{"seq":202291,"id":"CVE-2026-87491","ts":1789400065369,"field":"zero_day","old":"false","new":"true"},{"seq":202290,"id":"CVE-2026-87491","ts":1789400065369,"field":"exploit_available","old":"false","new":"true"},{"seq":202289,"id":"CVE-2026-87491","ts":1789400065369,"field":"exploited","old":"false","new":"true"},{"seq":202288,"id":"CVE-2026-87491","ts":1789400065369,"field":"kev","old":"false","new":"true"},{"seq":202287,"id":"CVE-2026-87491","ts":1789400065369,"field":"cvss","old":null,"new":"8.8"},{"seq":202286,"id":"CVE-2026-87491","ts":1789400065369,"field":"severity","old":"none","new":"high"},{"seq":201018,"id":"CVE-2026-87491","ts":1789397619220,"field":"zero_day","old":"true","new":"false"},{"seq":201017,"id":"CVE-2026-87491","ts":1789397619220,"field":"exploit_available","old":"true","new":"false"},{"seq":201016,"id":"CVE-2026-87491","ts":1789397619220,"field":"exploited","old":"true","new":"false"},{"seq":201015,"id":"CVE-2026-87491","ts":1789397619220,"field":"kev","old":"true","new":"false"},{"seq":201014,"id":"CVE-2026-87491","ts":1789397619220,"field":"cvss","old":"8.8","new":null},{"seq":201013,"id":"CVE-2026-87491","ts":1789397619220,"field":"severity","old":"high","new":"none"},{"seq":199711,"id":"CVE-2026-87491","ts":1789395569325,"field":"zero_day","old":"false","new":"true"},{"seq":199710,"id":"CVE-2026-87491","ts":1789395569325,"field":"exploit_available","old":"false","new":"true"},{"seq":199709,"id":"CVE-2026-87491","ts":1789395569325,"field":"exploited","old":"false","new":"true"},{"seq":199708,"id":"CVE-2026-87491","ts":1789395569325,"field":"kev","old":"false","new":"true"},{"seq":199707,"id":"CVE-2026-87491","ts":1789395569325,"field":"cvss","old":null,"new":"8.8"},{"seq":199706,"id":"CVE-2026-87491","ts":1789395569325,"field":"severity","old":"none","new":"high"},{"seq":198952,"id":"CVE-2026-87491","ts":1789392257424,"field":"zero_day","old":"true","new":"false"},{"seq":198951,"id":"CVE-2026-87491","ts":1789392257424,"field":"exploit_available","old":"true","new":"false"},{"seq":198950,"id":"CVE-2026-87491","ts":1789392257424,"field":"exploited","old":"true","new":"false"},{"seq":198949,"id":"CVE-2026-87491","ts":1789392257424,"field":"kev","old":"true","new":"false"},{"seq":198948,"id":"CVE-2026-87491","ts":1789392257424,"field":"cvss","old":"8.8","new":null},{"seq":198947,"id":"CVE-2026-87491","ts":1789392257424,"field":"severity","old":"high","new":"none"},{"seq":197285,"id":"CVE-2026-87491","ts":1789384296286,"field":"zero_day","old":"false","new":"true"},{"seq":197284,"id":"CVE-2026-87491","ts":1789384296286,"field":"exploit_available","old":"false","new":"true"},{"seq":197283,"id":"CVE-2026-87491","ts":1789384296286,"field":"exploited","old":"false","new":"true"},{"seq":197282,"id":"CVE-2026-87491","ts":1789384296286,"field":"kev","old":"false","new":"true"},{"seq":197281,"id":"CVE-2026-87491","ts":1789384296286,"field":"cvss","old":null,"new":"8.8"},{"seq":197280,"id":"CVE-2026-87491","ts":1789384296286,"field":"severity","old":"none","new":"high"},{"seq":196559,"id":"CVE-2026-87491","ts":1789383761792,"field":"zero_day","old":"true","new":"false"},{"seq":196558,"id":"CVE-2026-87491","ts":1789383761792,"field":"exploit_available","old":"true","new":"false"},{"seq":196557,"id":"CVE-2026-87491","ts":1789383761792,"field":"exploited","old":"true","new":"false"},{"seq":196556,"id":"CVE-2026-87491","ts":1789383761792,"field":"kev","old":"true","new":"false"},{"seq":196555,"id":"CVE-2026-87491","ts":1789383761792,"field":"cvss","old":"8.8","new":null},{"seq":196554,"id":"CVE-2026-87491","ts":1789383761792,"field":"severity","old":"high","new":"none"},{"seq":195463,"id":"CVE-2026-87491","ts":1789380577134,"field":"zero_day","old":"false","new":"true"},{"seq":195462,"id":"CVE-2026-87491","ts":1789380577134,"field":"exploit_available","old":"false","new":"true"},{"seq":195461,"id":"CVE-2026-87491","ts":1789380577134,"field":"exploited","old":"false","new":"true"},{"seq":195460,"id":"CVE-2026-87491","ts":1789380577134,"field":"kev","old":"false","new":"true"},{"seq":195459,"id":"CVE-2026-87491","ts":1789380577134,"field":"cvss","old":null,"new":"8.8"},{"seq":195458,"id":"CVE-2026-87491","ts":1789380577134,"field":"severity","old":"none","new":"high"},{"seq":194414,"id":"CVE-2026-87491","ts":1789378785850,"field":"zero_day","old":"true","new":"false"},{"seq":194413,"id":"CVE-2026-87491","ts":1789378785850,"field":"exploit_available","old":"true","new":"false"},{"seq":194412,"id":"CVE-2026-87491","ts":1789378785850,"field":"exploited","old":"true","new":"false"},{"seq":194411,"id":"CVE-2026-87491","ts":1789378785850,"field":"kev","old":"true","new":"false"},{"seq":194410,"id":"CVE-2026-87491","ts":1789378785850,"field":"cvss","old":"8.8","new":null},{"seq":194409,"id":"CVE-2026-87491","ts":1789378785850,"field":"severity","old":"high","new":"none"},{"seq":193201,"id":"CVE-2026-87491","ts":1789376520256,"field":"zero_day","old":"false","new":"true"},{"seq":193200,"id":"CVE-2026-87491","ts":1789376520256,"field":"exploit_available","old":"false","new":"true"}]}