EUVD-2026-74529
GHSA-8x3p-8g9v-xc7m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure user to crafted HTML page
-
DeliveryDeliver malicious JavaScript to unpatched Chrome
-
ExploitTrigger V8 out-of-bounds write in renderer heap
-
ExecutionCorrupt V8 object metadata to gain code execution
-
PersistExecute arbitrary code within Chrome renderer sandbox
-
ImpactExfiltrate browser-stored session data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must navigate to an attacker-controlled or compromised web page using an unpatched Chrome version prior to 153.0.8010.36 (UI:R). No authentication, elevated privileges, or special server-side configuration are required from the attacker side (PR:N, AC:L). The critical limiting factor is Chrome's renderer sandbox: this vulnerability achieves code execution confined to the sandboxed renderer process, not the host operating system - full OS compromise requires a separate, chained sandbox escape exploit. No non-default browser configuration is required for the base exploit to function; any user visiting the crafted page with an affected Chrome version is susceptible. |
| Impact | The provided CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a high-severity network-reachable flaw requiring only user interaction, but the 'inside the sandbox' qualifier in the description is the most important risk-moderating factor. Chromium's internal severity of 'Medium' - rather than Critical or High - is directly explained by S:U: the sandbox boundary is not escaped, so host OS impact requires a separate chained exploit. C:H/I:H/A:H are assessed against the renderer process itself, which holds browser session data, cookies, and credentials - meaningful but not equivalent to OS-level compromise. No public exploit has been identified, and this CVE is not in the CISA KEV catalog. EPSS data was not supplied in the input. Despite Chrome's ubiquitous global deployment footprint, realistic exploitation impact is bounded by sandbox containment absent a known chain. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page containing malicious JavaScript engineered to trigger the V8 out-of-bounds write. A victim on an unpatched Chrome version visits the page - via phishing link, malvertising, or a compromised website - causing the renderer to execute attacker-controlled code within Chrome's sandbox. From that position the attacker can harvest browser session cookies, saved passwords, and browsing data; achieving full OS-level persistence would require chaining this with a separate sandbox escape vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Out-of-bounds write in Chrome's V8 JavaScript engine allows remote attackers to execute arbitrary code within the renderer sandbox by directing a user to a crafted HTML page. All Google Chrome versions prior to 153.0.8010.36 are affected across desktop platforms. Impact is bounded by Chrome's renderer sandbox - an attacker achieves control over the renderer process and can access browser-stored data such as session cookies and saved credentials, but reaching the host OS would require a separately chained sandbox escape exploit. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: Chrome 153.0.8010.36. Update Google Chrome to version 153.0.8010.36 or later immediately, as detailed in the Chrome stable channel advisory at chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html. Chrome auto-updates by default; administrators managing enterprise deployments should verify installed versions and trigger a forced update cycle via group policy or their endpoint management platform. If immediate patching is operationally blocked, restricting user access to untrusted or unknown web origins via DNS filtering, web proxies, or browser isolation solutions reduces exposure to crafted-page delivery, though these controls add latency and complexity and do not eliminate risk from compromised legitimate sites.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
V8 is Google's open-source JavaScript and WebAssembly engine embedded in Chrome and Chromium-based browsers. CWE-787 (out-of-bounds write) in the V8 heap can corrupt internal object metadata, forge type information, or overwrite function pointers - enabling attacker-controlled code execution within the renderer process. This class of bug in JIT-compiled runtimes is particularly dangerous because V8 manages large typed arrays and JIT code buffers whose memory layout can be influenced by crafted JavaScript execution patterns. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all versions prior to 153.0.8010.36. Chromium's own internal severity rating of 'Medium' is consistent with the CVSS S:U (scope unchanged) metric, reflecting that the Chrome renderer sandbox boundary is not crossed by this vulnerability alone.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered crafted page (AV:N), passive user visit required (UI:R), no authentication (PR:N), sandbox not escaped (S:U), full renderer process compromise (C:H/I:H/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Articles & Coverage 2
Technical POC Analysis
The NVD description and Google's own fix note identify CVE-2026-87491 only as an "out-of-bounds write in V8" - CWE-787.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Google Chrome versions prior to 153.0.8010.36 contain a high-severity vulnerability in the V8 JavaScript engine that allows remote attackers to execute arbitrary code within the browser renderer process through a simple user visit to a malicious webpage. Successful exploitation grants attackers access to browser-stored sensitive data including session cookies and saved credentials, potentially compromising authentication to email, banking, and other critical web applications across your organization. An immediate patch is available and deployment is urgent.
Apply vendor patch.
Threat Model
5 threats: Elevation of Privilege, Denial of Service, Information Disclosure and 2 more
6-step attack chain with trust boundaries and controls
Full threat model - attack chain, trust boundaries, controls per stage and evidence - is part of the Pro and Business plans.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Same weakness CWE-787 – Out-of-bounds Write
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB