CVE-2026-87491Vulnerability
Google Chromium V8 Out of Bounds Write Vulnerability
Reported by 9 independent sources · first reported by Volexity · last reported
Last reported 8 days ago
Fix due 23 Sep 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 87% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
12 reports, newest first · the exact sentence from each-
Mind the (Patch) Gap , Part 3: Analysis with Volexity Volcano, Threat Intel, and MCP“CVE-2026-87491”
-
Multiples vulnérabilités dans les produits Palo Alto Networks (15 octobre 2026)“Référence CVE CVE-2026-87491”
-
PAN-SA-2026-0013 Chromium: Monthly Vulnerability Update (October 2026) (Severity: HIGH)“CVE-2026-87491”
-
September 2026 CVE Landscape“CVE-2026-87491”
-
Cyber Brief 26-10 - September 2026“Chrome zero-day CVE-2026-87491 exploited in attacks”
-
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware“The attacks, detected on September 3 and 4, 2026, involved the chaining of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one impacting Windows Advanced Local Procedure Call (CVE-2026-85880) to break out of the browser's sandbox and achieve remote code executi…”
-
Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits“…olexity published a blog post detailing the simultaneous use of multiple chained zero-day exploits in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows (CVE-2026-85880) by two different Chinese advanced persistent threat (APT) actors.”
-
Bulletin d'actualité CERTFR-2026-ACT-040 (21 septembre 2026)“CVE-2026-87491”
-
Google Pixel phones pwned in zero-click attacks“Earlier this month, CISA added two Google Chromium vulnerabilities, CVE-2026-85046 and CVE-2026-87491, to its KEV catalog.”
-
Risky Bulletin: Anthropic agents went hacking again“Tracked as CVE-2026-87491, the zero-day is a memory corruption bug in Chrome's V8 JavaScript engine and was discovered by a student at the Seoul National University.”
-
Chinese espionage groups swarm to exploit triple-link chain of zero-days“The vulnerabilities include: CVE-2026-85046 and CVE-2026-87491, remote-code execution defects in the JavaScript engine for Chromium-based browsers; and CVE-2026-85880, a privilege-escalation zero-day that Microsoft disclosed Tuesday in Windows Advanced Local Procedure Call.”
-
Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows“…box through the Type confusion vulnerability (CVE-2026-85046), then combines a separate WebAssembly defect to escape the V8 sandbox (CVE-2026-87491).”
Indicators reported together
named in the same reports- chinadigitaltimes[.]topin 2 reports
- americanprgoress[.]topin 2 reports
- thecovnresation[.]comin 2 reports
- cloud.shinewrist[.]netin 2 reports
Copy these 4 indicators · defanged
Also named with it: CVE-2026-85046, CVE-2026-85880, CVE-2026-58704, CVE-2025-39964, CVE-2026-53266, CVE-2026-76460, CVE-2026-76461, CVE-2025-39682, CVE-2026-87886, CVE-2023-54391, CVE-2026-65660, CVE-2026-83548, CVE-2026-83549, CVE-2026-82329, CVE-2026-19490, CVE-2026-65400
Thanks — we review every report.