A 'Medium' Severity Zero-Day That Someone Is Actually Exploiting: Chrome V8's CVE-2026-87491

The short version//

Five days ago we wrote about CVE-2026-85046 — a V8 type-confusion bug being exploited in the wild, patched Sep 3, on KEV within 24 hours. That was zero-day number six of 2026. CVE-2026-87491 is number seven: an out-of-bounds write (CWE-787) in V8, Chrome's JavaScript engine, that lets a remote attacker execute arbitrary code inside the sandbox via a crafted HTML page. Google shipped the fix Sep 8 in Chrome 153.0.8010.36 (Linux) and .36/.37 (Windows/macOS), and CISA added it to the KEV catalog on Sep 9 with a federal due date of Sep 23.

The pattern is the story: two exploited V8 bugs in five days, both fixed by "update your browser," and Google's own severity label on this one is Medium. On an actively exploited bug.

The count, updated//

Our Sep 5 post tallied six exploited Chrome zero-days through August. Here's the honest list as of today:

CVE	On KEV since	Component
CVE-2026-2441	Feb 17	Chromium
CVE-2026-3909	Mar 13	Skia
CVE-2026-3910	Mar 13	V8
CVE-2026-5281	Apr 1	Dawn
CVE-2026-11645	Jun 9	V8
CVE-2026-85046	Sep 4	V8
CVE-2026-87491	Sep 9	V8

Three of the last four are V8. The JavaScript engine is where the pressure is, which makes sense — it's the part of your browser that runs untrusted code by design, every page load.

What we know (and what Google is holding back)//

Google's release note states only that "an exploit for CVE-2026-87491 exists in the wild" — no payload details, no actor attribution, the usual "get people to update first" silence. The Chromium issue tracker entry is login-walled; bug details are restricted "until a majority of users are updated with a fix," per Google's own note in the release post. So: OOB write, crafted HTML page, code execution inside the sandbox — and that's genuinely all we can say without overclaiming.

The reporter is Jihyeon Jeong of the Compsec Lab at Seoul National University, who reported it on Aug 6 and collected a $2,500 bounty. So the bug sat in Google's queue for about five weeks before the in-the-wild fix shipped — which is normal for Chrome's process and says nothing about how long the wild exploit predates Aug 6.

The severity-label problem (the part worth stealing)//

Google rated this Medium and published no vector of its own (NVD's assessment is still pending; CISA has assigned 8.8 HIGH as an ADP). Meanwhile CISA put it on KEV the next day. Both are right, in their frame: "Medium" is Chromium's internal risk score for a sandboxed code-exec bug; KEV membership means someone has an exploit and used it.

This is a live test case for patch tooling that keys off vendor severity labels. Any scanner or prioritization pipeline that sorts by CVSS score or vendor rating will file this as "Medium — schedule sometime," while the evidence says "exploited, deadline Sep 23." The lesson from our vCenter post still holds: KEV = proven, and it outranks whatever label the vendor printed.

One honest contrast with this week's other KEV story (the NetScaler auth bypass): CISA did not attach a forensic-triage requirement to CVE-2026-87491 — for a browser, remediation discharges the obligation. Patching is the forensics here; you can't reasonably audit which of your tabs was the trigger.

What you should do tonight//

1. Update Chrome to 153.0.8010.36 or later (.37 on Windows/macOS). More > Help > About Google Chrome, then relaunch — and confirm the version string, because "updated" is a claim until you read it back.
2. Audit your Chromium derivatives. Headless Chromium in Docker images (puppeteer, playwright), CI containers, and Electron apps each pin their own V8 build. If an image or app hasn't been rebuilt since Sep 8, it still has this bug — same audit as last week's post, new version floor.
3. If you run Edge, Opera, Brave, or anything Chromium-derived: the KEV entry text notes the flaw "could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera." They're not "probably fine" — they'll get their own builds from the same V8 fix; apply them.
4. Use Sep 23 as your deadline. Federal due date, good properties for a personal lab too.