CVE-2026-87491: Out of Bounds Write in V8 in Google Chrome Prior to 153.0.8010.36
A NVD · · CVE-2026-87491
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key metrics
- EPSS
- 0%
Key insight
The vulnerability enables arbitrary code execution within the Chrome sandbox via crafted HTML pages, but currently shows no documented active exploitation.
Description
CVE-2026-87491 is an out-of-bounds write vulnerability in Chrome's V8 JavaScript engine prior to version 153.0.8010.36. The vulnerability is triggered by crafted HTML pages and enables remote code execution within the sandbox. Classified with Chromium severity 'Medium', exploitation typically requires user interaction (visiting a malicious webpage). No indication of active wild exploitation at this time.
Risk score
- cvss base
- 0.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 0.00
- industry weight
- 1.21
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
Path: operational