Out-of-bounds write in Chromium V8 allows code execution from a crafted web page (CVE-2026-87491)
CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-09-09 alongside Volexity's report of spear-phishing chains using it, so any fleet still on a pre-153 Chrome build can be compromised by a single visited page.
An out-of-bounds write in Chrome's V8 JavaScript engine lets a remote attacker execute arbitrary code inside the renderer sandbox when a user loads a crafted HTML page. Reporting describes it being chained with a Windows privilege escalation to escape the sandbox and gain full code execution on the host.
Affected: Google Chrome desktop < 153.0.8010.36 (Canadian Cyber Centre cites prior to 153.0.8010.37); Chromium-based browsers including Microsoft Edge and Opera that embed the affected V8
How to Test
Open chrome://settings/help (or Edge's About page) and confirm the build is at or above 153.0.8010.36; in managed fleets, inventory browser versions via your endpoint management console. For compromise triage, review proxy and email gateway logs for spear-phishing links matching the activity Volexity describes in its 2026-09-09 write-up and check affected hosts for the paired Windows privilege escalation activity.
How to Patch
Update Chrome to 153.0.8010.36/153.0.8010.37 or later on all desktop platforms and relaunch the browser so the new binary is loaded; apply the corresponding Chromium updates for Microsoft Edge, Opera and other embedders as soon as those vendors publish them, and enforce the minimum version through browser management policy.