CVE-2026-87491: Google Chromium V8 out-of-bounds write in JavaScript engine

CVE-2026-87491 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2026-09-09

Google Chromium's V8 JavaScript engine contains an out-of-bounds memory write vulnerability that allows attackers to execute arbitrary code within the browser sandbox by serving a crafted web page. This affects all major Chromium-based browsers including Chrome, Microsoft Edge, and Opera, potentially compromising user security and data when visiting malicious websites.

Technologies: Google Chrome, Google Chromium, Google Chromium V8, Microsoft Edge. Vendors: Google, Microsoft.

Quick answers

Is CVE-2026-87491 exploited in the wild?
Yes. CVE-2026-87491 is known to be exploited in the wild, first recorded on 9 September 2026. Treat it as urgent.
How severe is CVE-2026-87491?
Critical severity, with a CVSS score of 8.8, published 9 September 2026.
Which products and versions are affected?
Google Chrome multiple versions; Google Chromium multiple versions; Microsoft Edge multiple versions.
Is there a fix for CVE-2026-87491?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-87491 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-87491?
Check whether you run Google Chrome, Google Chromium, Google Chromium V8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-87491 is an out-of-bounds write vulnerability in the V8 JavaScript engine that powers Google Chromium and all Chromium-derived browsers. The vulnerability is triggered through a specially crafted HTML page delivered over the network, requiring only that a user visits a malicious website. An attacker can exploit this to achieve arbitrary code execution within the browser's sandbox environment. This vulnerability has been observed being actively exploited in the wild, indicating real-world attack campaigns. Patch availability and version information should be obtained from the vendor's security advisories.

Affected products

  • Google Chromium multiple versions
  • Google Chrome multiple versions
  • Microsoft Edge multiple versions
  • Opera Opera Browser multiple versions

Timeline

  • 2026-09-09: disclosed
  • exploited: Actively exploited in the wild

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.