CVE-2026-87491

Google Chromium V8

score 75Known exploited · added 2026-09-09Public PoC ×1

Summary

Google Chromium V8 Out of Bounds Write Vulnerability

Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Published 2026-09-09 · first seen here 2026-10-10

CISA required action (due 2026-09-23): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Analysis & write-ups

Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits · Volexity

Exploit availability

Public exploit code lowers the bar for attackers, so prioritise patching and hunting. These repositories are unverified. Fake PoCs that contain malware are common, so never run them outside an isolated lab.

SneakyNachos/CVE-2026-87491-and-CVE-2026-85046-the-bagel-fell-off-the-counter · ★5 · created 2026-09-10

Where it shows in your logs

Client software (browser, Office, PDF, archive tools) · Memory corruption (overflow, use-after-free) high confidence

What to look for

Browser or document reader crashes followed by a new process or file write
The vulnerable app starting script or command interpreters (e.g. winword.exe or chrome.exe spawning powershell.exe, cmd.exe, mshta.exe, wscript.exe)
Files written to Startup folders, %AppData% or %Temp% right after opening a document or page
Outbound connections from processes the vulnerable app spawned
Related email delivery: attachments of the exploited file type, or links from the same campaign

Data sources

Process creation · ATT&CK DS0009 Process Creation

Sentinel: DeviceProcessEventsSecurityEvent (4688)Sysmon Event ID 1_Im_ProcessCreate
Splunk: Endpoint.ProcessesXmlWinEventLog:Microsoft-Windows-Sysmon/OperationalWinEventLog:Security (4688)
CrowdStrike: ProcessRollup2SyntheticProcessRollup2

File creation · ATT&CK DS0022 File Creation

Sentinel: DeviceFileEventsSysmon Event ID 11_Im_FileEvent
Splunk: Endpoint.FilesystemSysmon Event ID 11
CrowdStrike: NewExecutableWrittenNewScriptWritten*FileWritten events

Network connections · ATT&CK DS0029 Network Connection Creation / Network Traffic Flow

Sentinel: DeviceNetworkEventsCommonSecurityLog (firewall)_Im_NetworkSession
Splunk: Network_Traffic.All_TrafficFirewall sourcetypes (pan:traffic, fortigate_traffic, cisco:asa)
CrowdStrike: NetworkConnectIP4NetworkReceiveAcceptIP4NetworkConnectIP6

Email delivery · ATT&CK DS0015 Application Log Content

Sentinel: EmailEventsEmailAttachmentInfoEmailUrlInfo
Splunk: Email.All_Email
CrowdStrike: Falcon Next-Gen SIEM: email security connectors

A generic baseline worked out from the product type and weakness (CWE-787), not a detection. Check table and field names against your environment. Hunt queries for Sigma, Splunk, Sentinel and CrowdStrike are coming.

News & advisories

Chromium CVE-2026-87491: Out of bounds write in V8 · Microsoft MSRC