By Google shipped Chrome 153 on September 8 to close CVE-2026-87491, an out-of-bounds write in V8 that attackers are already using in the wild. CISA added it to the Known Exploited Vulnerabilities catalog the next day and gave federal agencies until September 23 to patch. If you haven’t restarted Chrome since Monday, you’re running a browser with a confirmed, weaponized vulnerability. This is the one where you close the tab and update.
What CVE-2026-87491 Actually Does
The bug lives in V8, Chrome’s JavaScript and WebAssembly engine. Visiting a malicious page triggers an out-of-bounds write — the kind of memory-corruption primitive that can hand an attacker code execution. That execution, however, lands inside Chrome’s renderer sandbox, not the OS. By itself, the flaw doesn’t escape Chrome’s process boundary.
That’s the nuance worth holding onto: sandboxed renderer code execution is serious, but it’s not full system compromise — unless it’s paired with a second sandbox-escape flaw. Google has not confirmed whether CVE-2026-87491 is being chained in real-world attacks. That silence is deliberate and standard. Treat the absence of confirmation as “we don’t know yet” rather than “it isn’t happening.”
Two V8 Zero-Days in Five Days — The Pattern Is the Story
CVE-2026-87491 would be notable on its own. It’s more notable in context. Five days earlier, on September 3, Google patched CVE-2026-85046 — another V8 zero-day, this one a type confusion flaw in the compiler. And these two aren’t isolated incidents. Of the seven Chrome zero-days patched in 2026, four are in V8:
- CVE-2026-3910 — V8 type confusion
- CVE-2026-11645 — V8 memory safety
- CVE-2026-85046 — V8 compiler type confusion (Sept 3)
- CVE-2026-87491 — V8 out-of-bounds write (Sept 8)
Four of seven (57%) Chrome zero-days this year trace back to the same engine. Two of those landed within the same week. This is not bad luck — it’s sustained research pressure on the component that executes untrusted code from every website you visit. V8 is a massive C++ JIT compiler. Memory-safety bugs in that environment aren’t aberrations; they’re structurally expected. The question was always when, not whether.
CISA Has Two Active Chrome Deadlines Right Now
If you manage infrastructure, you now have two concurrent Chrome patch deadlines from CISA:
- September 18: CVE-2026-85046 (Chrome 152 / V8 type confusion)
- September 23: CVE-2026-87491 (Chrome 153 / V8 out-of-bounds write)
The KEV catalog is technically a federal mandate. But treating it as a mandatory signal for the rest of your organization is the right call — CISA only adds entries when exploitation is confirmed and active. Update to Chrome 153.0.8010.36 or later and you cover both deadlines at once.
Electron Developers Have Their Own Problem
If you ship a desktop app built on Electron, “update Chrome” isn’t your action item — “update your app” is. Electron 43.1.0, released July 8, bundles Chromium 150. That’s below the patched threshold. Your users running Electron-based apps — VS Code, Slack, Discord, and thousands of others — are exposed to V8 vulnerabilities through your app, not through Chrome.
Check the Chromium version bundled with your Electron release. If it predates 153.0.8010.36, cut a new build and push it. The same obligation applies to any CEF-based application. Help Net Security’s breakdown has more detail on affected Chromium versions.
Three Things to Do Right Now
- Update Chrome: Menu → Help → About Google Chrome → wait for 153.0.8010.36 or later → restart. The restart is not optional — Chrome won’t apply the update while the browser is open.
- Audit Electron apps: If you build or maintain desktop apps, check your bundled Chromium version and cut an updated release if you’re below 153.0.8010.36.
- Enforce auto-update policies: CISA’s September 23 deadline is a forcing function. If your organization doesn’t have Chrome auto-update enforced via policy, now is the time to fix that.
One footnote worth noting: the researcher who found CVE-2026-87491, Jihyeon Jeong of Seoul National University’s Compsec Lab, received a $2,500 bug bounty. For a weaponized zero-day that earned a CISA KEV entry and a federal patch mandate, that number is embarrassingly low. The patch ecosystem depends on external researchers finding bugs before nation-state actors weaponize them. The rewards should reflect that reality.
