A Chrome vulnerability that attackers were already exploiting reaches its federal patching deadline today. CVE-2026-87491, an out-of-bounds write in Chrome's V8 JavaScript and WebAssembly engine, lets an attacker run code inside the browser sandbox when a victim opens a crafted web page. The U.S. Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog on 9 September 2026 and set 23 September as the deadline for federal civilian agencies to remediate it.
Photo: Sebastiaan ter Burg from Utrecht, The Netherlands (CC BY-SA 2.0), Wikimedia Commons.
What made this one urgent
Google said it was aware of an exploit for CVE-2026-87491 circulating in the wild, though it has not detailed who is behind the activity. Separate reporting describes the flaw being chained with a Windows privilege-escalation bug to escape the browser sandbox and gain full code execution on the host, and ties some of the activity to spear-phishing campaigns. The bug carries a CVSS score of 8.8 and was reported by an outside researcher who received a bug bounty for the find.
Where the fix lives
Google shipped the fix in Chrome 153.0.8010.36 for Linux, and 153.0.8010.36/.37 for Windows and macOS, as part of a stable-channel release on 8 September that carried 230 security fixes in total. Because the flaw sits in the open-source Chromium V8 engine rather than Chrome-specific code, every Chromium-based browser needed its own release to pick up the fix. Microsoft Edge, Brave, Opera and Vivaldi each ship it on their own version numbers and schedules, so a Chrome-only inventory will miss exposed endpoints.
What MSPs and IT teams should check now
Confirm managed Chrome fleets are on 153.0.8010.36 or later, not just scheduled to update.
Check Edge-Chromium and other Chromium-based browsers separately — map CVE-2026-87491 to the vendor build that carries the upstream V8 fix.
Verify enterprise update rings actually completed rather than trusting a policy setting.
Record patch attestation with an owner and evidence, since CISA's deadline applies to federal agencies but sets the practical bar most enterprise buyers expect.
The federal deadline is a compliance marker, not a universal cutoff — but an actively exploited sandbox-escape chain in a browser engine used everywhere is worth treating as urgent regardless of who technically owes CISA a report.
In 5 minutes, check whether your SME or MSP falls under NIS2 and score your readiness on risk management and incident reporting. Free, stays in your browser.
We use technical cookies to keep the site running. With your consent we also use analytics and marketing cookies to improve the product. You can change your mind at any time.
01
NecessaryAlways on
Required for the site to work (login, preferences, security). Always on.
02
Help us understand how the site is used, in aggregate and anonymous form.
03
Let us measure how well our campaigns perform. Off by default.
