# CVE-2026-87491: Google Chromium V8 out-of-bounds write in JavaScript engine

Source: https://junglewise.ai/threats/cve-2026-87491-google-chromium-v8-out-of-bounds-write-in-javascript-engine  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-87491 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2026-09-09

Google Chromium's V8 JavaScript engine contains an out-of-bounds memory write vulnerability that allows attackers to execute arbitrary code within the browser sandbox by serving a crafted web page. This affects all major Chromium-based browsers including Chrome, Microsoft Edge, and Opera, potentially compromising user security and data when visiting malicious websites.

Technologies: [Google Chrome](https://junglewise.ai/threats/technologies/chrome), [Google Chromium](https://junglewise.ai/threats/technologies/chromium), [Google Chromium V8](https://junglewise.ai/threats/technologies/chromium-v8), [Microsoft Edge](https://junglewise.ai/threats/technologies/edge). Vendors: [Google](https://junglewise.ai/threats/vendors/google), [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-87491 exploited in the wild?** Yes. CVE-2026-87491 is known to be exploited in the wild, first recorded on 9 September 2026. Treat it as urgent.

**How severe is CVE-2026-87491?** Critical severity, with a CVSS score of 8.8, published 9 September 2026.

**Which products and versions are affected?** Google Chrome multiple versions; Google Chromium multiple versions; Microsoft Edge multiple versions.

**Is there a fix for CVE-2026-87491?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-87491 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-87491?** Check whether you run Google Chrome, Google Chromium, Google Chromium V8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-87491 is an out-of-bounds write vulnerability in the V8 JavaScript engine that powers Google Chromium and all Chromium-derived browsers. The vulnerability is triggered through a specially crafted HTML page delivered over the network, requiring only that a user visits a malicious website. An attacker can exploit this to achieve arbitrary code execution within the browser's sandbox environment. This vulnerability has been observed being actively exploited in the wild, indicating real-world attack campaigns. Patch availability and version information should be obtained from the vendor's security advisories.

## Affected products

- Google Chromium multiple versions
- Google Chrome multiple versions
- Microsoft Edge multiple versions
- Opera Opera Browser multiple versions

## Timeline

- 2026-09-09: disclosed
- exploited: Actively exploited in the wild

## Related threats

- [Google Chrome out of bounds read in Skia](https://junglewise.ai/threats/cve-2026-126922-out-of-bounds-read-in-skia-in-google-chrome-prior-to-157-0-8103)
- [Google Chrome use after free in Accessibility](https://junglewise.ai/threats/cve-2026-126921-use-after-free-in-accessibility-in-google-chrome-prior-to-157-0)
- [Google Chrome information leak in Skia](https://junglewise.ai/threats/cve-2026-126920-information-leak-in-skia-in-google-chrome-prior-to-157-0-8103-78)
- [Google Chrome use-after-free in BrowserTag](https://junglewise.ai/threats/cve-2026-126919-use-after-free-in-browsertag-in-google-chrome-prior-to-157-0)
- [Google Chrome use-after-free in Layout](https://junglewise.ai/threats/cve-2026-126918-use-after-free-in-layout-in-google-chrome-prior-to-157-0-8103-78)