Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Google Chrome V8 out-of-bounds write security flaw (CVE-2026-87491)

Vulnerability
First reported
Last updated
Happening score
H score 36
2 unique sources, 3 articles

Summary

Hide ▲

CVE-2026-87491 is a V8 flaw in Google Chrome that allows arbitrary code execution inside the browser sandbox through a crafted HTML page. Google patched Chrome in 153.0.8010.36/.37 for Windows and macOS, and 153.0.8010.36 for Linux, after saying an exploit existed in the wild. The same bug was later tied to the BlueMoon chain, where Volexity and Proofpoint described exploitation of CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 to drive Chrome sandbox escape, Windows local privilege escalation, and post-exploitation delivery in separate spear-phishing activity.

Related Happenings

UNC3569 Sogou Input Method exploitation campaign

Campaign
H score89 First: 11.09.2026 10:14 Last: 11.09.2026 10:14 Sources 1

About this happening: UNC3569 is using a crafted sgbiz: link to exploit Tencent’s Sogou Input Method for Windows and deploy the GRAYRABBIT backdoor. Gen Digital says the activity involv...

Open Happening

GRAYRABBIT backdoor deployment via Sogou Input Method exploit

Malware Activity
H score89 First: 11.09.2026 10:14 Last: 11.09.2026 10:14 Sources 1

About this happening: The GRAYRABBIT backdoor was deployed in a live intrusion against Sogou Input Method users, giving attackers a remote command shell and the ability to stage additional...

Open Happening

Google Chrome V8 type confusion security flaw (CVE-2026-85046)

Vulnerability
H score36 First: 04.09.2026 10:18 Last: 04.09.2026 10:18 Sources 1

How related: CVE-2026-85046: a type-confusion flaw in Chrome’s V8 JavaScript engine that provides arbitrary memory access inside the V8 sandbox

About this happening: CVE-2026-85046 is a Google Chrome V8 type-confusion vulnerability that was exploited in the wild before Google shipped fixes in 152.0.7977.82/.83 for Windows a...

Open Happening

CDP-Enable-BOF activates Chrome DevTools Protocol inside live Windows browsers for post-exploitation session access

Technical Analysis
H score23 First: 14.08.2026 14:07 Last: 14.08.2026 14:07 Sources 1

About this happening: CDP-Enable-BOF now enables Chrome DevTools Protocol access inside a live Google Chrome or Microsoft Edge process on Windows, raising the risk of cookie theft...

Open Happening

Chrome V8 JavaScript engine out-of-bounds read/write zero-day exploited in the wild (CVE-2026-11645)

Vulnerability
H score45 First: 09.06.2026 09:56 Last: 09.06.2026 09:56 Sources 1

About this happening: Google has patched CVE-2026-11645, a Chrome V8 JavaScript engine zero-day that was exploited in the wild and could let remote attackers run code inside the browser...

Open Happening

Timeline

  1. 09.09.2026 12:11 3 articles · 13d ago

    Security researcher reports CVE-2026-87491 in Chrome V8

    Initial Disclosure

    Security researcher Jihyeon Jeong of Compsec Lab, Seoul National University discovered and reported CVE-2026-87491, an out-of-bounds bug in V8, on August 6, 2026.

    Show sources
    Open in new tab
  2. 09.09.2026 12:11 2 articles · 13d ago

    Google patches Chrome V8 zero-day exploited in the wild

    Mitigation Patch Update

    Google released Chrome updates that patch CVE-2026-87491, a V8 out-of-bounds write in Chrome prior to 153.0.8010.36 that can let a remote attacker execute arbitrary code inside the sandbox via a crafted HTML page. Google said it is aware an exploit exists in the wild and directed users to install versions 153.0.8010.36/.37 on Windows and macOS, or 153.0.8010.36 on Linux, then relaunch Chrome.

    Show sources
    Open in new tab