PT-2026-88591 · Google+2 · Google Chrome+2
CVE-2026-87491
·
Published
2026-08-06
·
Updated
2026-09-12
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Google has released emergency Chrome updates addressing 230 vulnerabilities — including an actively exploited V8 out-of-bounds write tracked as CVE-2026-87491. The bug, described as a medium-severity out-of-bounds write in the V8 JavaScript/WebAssembly engine, has been used in the wild to achieve code execution inside Chrome’s renderer sandbox.
Key points:
- Active exploit: attackers have weaponized the V8 flaw in live attacks, making this a high-priority patch for all users.
- Technical risk: an out-of-bounds write can corrupt memory and enable arbitrary code execution within the renderer; combined with other flaws it can become a full sandbox escape.
Recommended actions (immediate):
- Patch now: apply the latest Chrome update across endpoints and enforce automatic updates where possible.
- Enterprise controls: use browser isolation, restrict extensions, enforce Site Isolation and Safe Browsing policies, and consider temporarily limiting WebAssembly where feasible.
- Detection & response: hunt for abnormal renderer process behavior, unexpected child processes or memory-corruption crashes, and deploy EDR rules targeting suspicious V8 activity.
Dexmond analysis: out-of-bounds vulnerabilities in V8 are a recurring vector for fast, reliable exploitation because they target the engine that executes untrusted web content. Defence-in-depth reduces the blast radius: rapid patching, isolation, telemetry-driven detection, and strong update policies are the most effective mitigations while vendors release fixes.
Actionable priority: update browsers immediately and validate update enforcement across managed devices.
#Dexmond #CyberSecurity #Chrome #V8 #ZeroDay
Fix
RCE
LPE
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Google Chrome
Edgechromium
Chromium