CVE-2026-87491 · High · CISA KEV

Chromium V8 Out-of-Bounds Write: Remote Code Execution via Crafted HTML

Threat Engine Auto-Feed · data current as of 2026-09-10

An out-of-bounds write vulnerability in Google Chromium V8 allows remote attackers to execute arbitrary code within the browser sandbox. This critical flaw, listed in CISA KEV, affects multiple web browsers utilizing Chromium and can be triggered by visiting a crafted HTML page. Its presence in the KEV catalog indicates active exploitation in the wild.

  • CVSS:
  • EPSS percentile: 0.53302
  • Exploitation pressure: 57/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 53th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

An out-of-bounds write occurs when a program attempts to write data to a memory location outside of the allocated buffer. This can corrupt data, crash the program, or, in severe cases, allow an attacker to execute their own code by manipulating program flow or data structures.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations whose users frequently browse the internet or interact with web-based applications
  • Enterprises with a high volume of email and web traffic, increasing exposure to malicious links or sites
  • Any organization using web browsers based on Chromium (e.g., Chrome, Edge, Opera) for daily operations

Misconfigurations that escalate it

  • Lack of robust web filtering or content inspection that could block access to malicious HTML pages
  • Insufficient endpoint detection and response (EDR) capabilities to identify post-exploitation activity within the browser sandbox
  • Outdated browser versions that have not applied patches for known vulnerabilities

High-impact scenarios

  • Remote code execution within the browser sandbox, potentially leading to further system compromise if sandbox escapes are chained
  • Initial access for financially motivated actors (e.g., FIN7, LockBit affiliates, APT38) targeting financial services
  • Espionage or data theft by state-sponsored groups (e.g., APT29, Scattered Spider) targeting technology sectors, particularly via supply-chain or SaaS compromise

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor for unusual process activity originating from browser processes, especially those attempting to access system resources outside typical browser operations.
  • Implement robust web filtering and proxy logs to identify attempts to access known malicious or suspicious websites.
  • Utilize endpoint detection and response (EDR) solutions to detect and alert on anomalous behavior within user endpoints, particularly related to browser activity.

Contain

  • Isolate affected endpoints from the network to prevent lateral movement.
  • Terminate suspicious browser processes and associated child processes.
  • Block access to known malicious URLs or domains identified during incident response.

Patch

  • Prioritize patching and updating all Chromium-based web browsers (Google Chrome, Microsoft Edge, Opera, etc.) to the latest secure versions immediately.
  • Implement a regular patching schedule for all end-user software, especially web browsers, to mitigate known vulnerabilities promptly.

Frontier verdict — High

This is a critical vulnerability due to its inclusion in CISA KEV, indicating active exploitation, and its potential for remote code execution via user interaction with a crafted HTML page.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.