Critical V8 Out‑of‑Bounds Write in Chrome (CVE‑2026‑87491) Actively Exploited in the Wild
What It Is — Google disclosed CVE‑2026‑87491, an out‑of‑bounds write in the V8 JavaScript/WebAssembly engine that allows arbitrary code execution when a crafted HTML page is rendered. The flaw is rated CVSS 8.8 (High) and is known to be exploited in the wild.
Exploitability — An active exploit exists; attackers can trigger the vulnerability through a malicious web page and break out of Chrome’s sandbox. No public proof‑of‑concept code has been released, but the presence of a real‑world exploit is confirmed by Google.
Affected Products — Google Chrome 153.0.8010.36 and later on Windows, macOS, and Linux; the underlying V8 engine used by Chromium‑based browsers.
Why It Matters for Trust & Control Assurance
- Continuous vulnerability monitoring – Detecting a zero‑day in a widely deployed browser underscores the need for automated feeds and real‑time alerts that feed into your risk register.
- Patch‑management evidence – Demonstrating that all endpoints received the Chrome 153 update provides auditable proof of due‑diligence for control objectives around timely remediation.
- Defensible audit trail – Maintaining logs of patch deployment and verification supports a credible control‑assurance posture that regulators and enterprise buyers increasingly demand.
Recommended Actions
- Verify that all corporate workstations run Chrome 153.0.8010.36 or newer; enforce auto‑update where possible.
- Integrate a vulnerability‑scanning tool that flags CVE‑2026‑87491 and tracks remediation status across the asset inventory.
- Document the patch‑deployment process and retain evidence (screenshots, SCCM logs, etc.) for audit purposes.
- Review your browser‑hardening policies (e.g., disabling unnecessary extensions, enabling site isolation) to reduce the attack surface.
Source: Security Affairs – Google fixes the seventh actively exploited Chrome zero‑day of 2026