CVE-2026-87491: Google Chromium V8 Out of Bounds Write Vulnerability
Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Overview
An out-of-bounds write in the V8 JavaScript engine affects Google Chrome prior to version 153.0.8010.36, and by extension other Chromium-based browsers including Microsoft Edge and Opera. The flaw stems from incorrect effect modeling in V8's Turboshaft compiler, which misclassifies a WebAssembly built-in as read-only when it can in fact invoke arbitrary JavaScript through accessor descriptors. An attacker who can direct a user to a crafted HTML page can chain this misclassification into memory corruption and arbitrary code execution within the renderer sandbox.
Vulnerability details
The Turboshaft compiler's descriptor for WasmGetOwnProperty declares the operation as non-throwing and memory-read-only, but the underlying Torque built-in calls GetPropertyWithReceiver, which can invoke arbitrary JavaScript when it encounters an accessor descriptor. Because the compiler believes no write can occur, Late Load Elimination retains a stale WasmDispatchTable tuple across the accessor callback. A subsequent call_indirect then combines a reloaded function pointer from a replacement WebAssembly instance with the implicit argument pointer from the original driver instance, producing a type-confused dispatch that writes outside intended memory bounds.
Exploitation requires the attacker to already hold arbitrary read/write access inside the V8 sandbox, which the published proof-of-concept models using Sandbox.MemoryView. With that primitive in place, the attacker forges a wasm_exception_tag_symbol accessor descriptor, places the accessor object in an exported exnref table, and triggers WasmGetOwnProperty through a throw_ref and WebAssembly.JSTag catch sequence. The mutated function table causes the stale dispatch tuple to execute the replacement instance's target function under the driver instance's trusted context, achieving code execution inside the sandbox. A user must visit or be redirected to a crafted HTML page for the attack to proceed.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Check Chrome version strings across managed endpoints against the 153.0.8010.36 boundary; any host running an earlier build is unpatched and exposed, regardless of observed traffic patterns.
- Monitor endpoint security telemetry for renderer process crashes that occur immediately after loading pages containing both WebAssembly modules and JavaScript accessor property definitions, particularly where the crash precedes any user-visible error, which differs from ordinary Wasm instability that typically produces console exceptions rather than silent renderer termination.
Remediation
Additional hardening
- Update Google Chrome to 153.0.8010.36 or later on Windows and Mac, and 153.0.8010.36 on Linux; apply equivalent updates to Microsoft Edge, Opera, and any other Chromium-based browsers in the environment. See References for the vendor advisory.
- Restrict or block WebAssembly execution via enterprise browser policy (for example, Chrome's DefaultJavaScriptJitSetting or WebAssembly-specific policies) on hosts where Wasm is not operationally required, reducing the attack surface until patching is complete.
- Apply network controls to prevent managed endpoints from reaching attacker-controlled or uncategorized web content, reducing the likelihood that users are directed to a crafted HTML page that initiates the exploit chain.
- Where browser isolation or remote browser isolation technology is available, route high-risk browsing sessions through it to contain any renderer-level compromise before it can affect the host.
Key dates
References
- https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-87491
- https://issues.chromium.org/issues/543557673
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-87491
Frequently asked questions
Does CVE-2026-87491 affect my FedRAMP authorization?
If Google Chromium V8 runs inside your authorization boundary, CVE-2026-87491 is your problem. CISA has listed it on the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of September 23, 2026. For a FedRAMP-authorized service, an unpatched KEV inside the boundary is an assessor finding. You remediate it or formally document a mitigation before your assessor and sponsoring agency raise it on your behalf.
How does Knox help me handle CVE-2026-87491?
Knox does not patch Google Chromium V8 for you. Under the FedRAMP shared-responsibility model, that remediation belongs to your team. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus continuous compliance monitoring and audit-artifact coverage that document the fix for your next assessment. The work of applying the patch is yours; managing your compliance posture while you do it is not something you handle alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues, including CVE-2026-87491, as part of ongoing operations. Exposure surfaces during continuous monitoring rather than only when an assessor flags it at review time, giving your team the lead time to act before it becomes a formal finding.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
What happens if CVE-2026-87491 isn't remediated by September 23, 2026?
An unremediated CVE-2026-87491 becomes a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing out the finding and documenting the remediation is what keeps your authorization clean and the agency relationship intact.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
