AppYour homeOperatorJournalAlerts
Request an introduction
Security issueGoogle Chrome

CVE-2026-87491

A memory flaw in Chrome's JavaScript engine that lets a web page run code. Google fixed it in Chrome 153 on 8 Sep 2026. It’s being used in attacks.

CVE-2026-87491Out of bounds write in V8
Attacks
Used in attacksOn CISA's list of flaws used in attacks since 9 Sep 2026. Every Google flaw on the list
Affected
  • Google Chrome before 153.0.8010.36 (153.0.8010.37 on Mac)
  • Brave before 1.95.100, the first Brave built on Chromium 153.0.8010.37
  • Microsoft Edge, Opera, Arc, Vivaldi and other browsers built on Chromium, until each ships the fix
  • Apps built on Electron, which carry their own copy of Chromium, until each ships it
Fixed in
Chrome 153.0.8010.36 (153.0.8010.37 on Mac), released 8 Sep 2026
In Brave
Brave 1.95.100, built on Chromium 153.0.8010.37, released 9 Sep 2026
Severity
Rated medium by Google. CVSS 8.8 out of 10 (high), scored by CISA.
Official name
Google Chromium V8 Out of Bounds Write Vulnerability
What's known.From Google’s release notes, CISA's catalogue of exploited flaws and NVD, checked 23 Oct 2026.

What it is

V8 is the part of Chrome that runs the JavaScript in every web page. This flaw is an out-of-bounds write: V8 can be tricked into writing past the end of the memory it was given. Google and NVD both describe the result the same way: a remote attacker can use a crafted web page to run code inside Chrome's sandbox.

Inside the sandbox, that code is fenced off from the rest of the Mac. Getting out takes a second flaw. Google hasn't said whether the attacks it knows of used one, or who was targeted.

Google rated it medium. It's being used in attacks all the same.

Is it being used in attacks?

Yes. Google’s release notes for Chrome 153.0.8010.36 say: “Google is aware that an exploit for CVE-2026-87491 exists in the wild.”

CISA, the US cybersecurity agency, added it to its catalogue of known exploited vulnerabilities on 9 Sep 2026, the day after the fix. CISA lists a flaw only when it has reliable evidence of it being exploited, and gave US federal agencies until 23 Sep 2026 to fix it.

Google keeps bug details private until most people have updated, and CISA doesn’t say who was attacked or how.

What to do

  1. Update Chrome, then relaunch it.Chrome → About Google Chrome in the menu bar. Chrome downloads updates by itself but only applies them when it relaunches, with your tabs.
  2. Do the same in every other browser you use.Brave, Edge, Arc, Vivaldi and Opera each have an About page in the app menu that checks for updates.
  3. Update apps built on Electron.Slack, Discord, Notion and many others carry their own copy of Chromium. The HARD app lists which ones on your Mac are behind.

Advisories that include it

  1. Brave on Chromium 152
  2. Chrome before 156.0.8078.47
  3. Apps built on Electron 41

Sources

  1. Stable Channel Update for Desktop: Chrome 153.0.8010.36/37The fix, rated medium by Google, and Google’s statement that an exploit exists in the wild.chromereleases.googleblog.com ·
  2. Brave 1.95.100 (Chromium 153.0.8010.37)The first Brave release built on a Chromium with the fix.github.com/brave ·
  3. Known Exploited Vulnerabilities catalog: CVE-2026-87491Added 9 Sep 2026: CISA has evidence it is being used in attacks.cisa.gov ·
  4. CVE-2026-87491The official description, and a CVSS score of 8.8 out of 10 from CISA.nvd.nist.gov ·
Every advisoryLook up any app, company or CVEThe HARD Mac app links its warnings here.