What is the CVSS score of CVE-2026-87491?

CVE-2026-87491 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-87491?

Google Chrome versions prior to 153.0.8010.36 contain a high-severity vulnerability in the V8 JavaScript engine that allows remote attackers to execute arbitrary code within the browser renderer…. A patch is available.

Is there a public PoC exploit available for CVE-2026-87491?

Yes, a public proof-of-concept exploit is available for CVE-2026-87491. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-87491?

Within 24 hours: identify all Chrome instances in your organization and assess your deployment mechanisms (enterprise policy, auto-update, or manual). Within 7 days: deploy Chrome version 153.0.8010.36 or later across all affected desktop platforms using your standard patch management process; for enterprise environments, configure managed policy updates to enforce version 153.0.8010.36 or later. Within 30 days: audit deployment completion to ensure all Chrome instances are at or above 153.0.8010.36, and review browser security policies to enforce auto-update enablement where feasible to prevent future patch delays.

Google Chrome CVE-2026-87491

EUVD-2026-74529 HIGH

Out-of-bounds Write (CWE-787)

2026-09-09 Chrome

GHSA-8x3p-8g9v-xc7m

RCE Buffer Overflow Google Memory Corruption

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

8.8 HIGH

Network-delivered crafted page (AV:N), passive user visit required (UI:R), no authentication (PR:N), sandbox not escaped (S:U), full renderer process compromise (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Threat Model Generated

Sep 10, 2026 - 11:30 vuln.today

POC Analysis Generated

Sep 09, 2026 - 19:36 vuln.today

Added to CISA KEV

Sep 09, 2026 - 19:34 CISA

Analysis Generated

Sep 09, 2026 - 11:26 vuln.today

Patch available

Sep 09, 2026 - 01:03 EUVD

CVE Published

Sep 09, 2026 - 00:09 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 09, 2026 - 00:09 cve.org

HIGH 8.8

DescriptionCVE.org

Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Articles & Coverage 2

POC Chrome V8 Sandbox Escape PoC Chaining CVE-2026-85046, CVE-2026-87491, CVE-2026-87606, and CVE-2026-87575 Sep 12, 2026 POC CVE-2026-85046 + CVE-2026-87491: Chained V8 Type Confusion and WASM Exploit for Chrome Renderer RCE Sep 10, 2026

AnalysisAI

Out-of-bounds write in Chrome's V8 JavaScript engine allows remote attackers to execute arbitrary code within the renderer sandbox by directing a user to a crafted HTML page. All Google Chrome versions prior to 153.0.8010.36 are affected across desktop platforms. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The victim must navigate to an attacker-controlled or compromised web page using an unpatched Chrome version prior to 153.0.8010.36 (UI:R). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a high-severity network-reachable flaw requiring only user interaction, but the 'inside the sandbox' qualifier in the description is the most important risk-moderating factor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: Chrome 153.0.8010.36. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: identify all Chrome instances in your organization and assess your deployment mechanisms (enterprise policy, auto-update, or manual). …

Threat intelligence, references, and detailed analysis are available after sign-in.