Posted on

Google Chrome CVE-2026-87491 – Actively Exploited V8 Zero-Day

Threat Overview

Google released Chrome 153 to the Stable Desktop channel on September 8, 2026 and confirmed that an exploit for CVE-2026-87491 exists in the wild. The vulnerability is an out-of-bounds write in the V8 JavaScript engine. Google’s advisory rates the issue Medium in the Chrome release notes, but the existence of a real-world exploit materially increases operational priority. Google has withheld exploit details while users update, so no trustworthy public exploit path, malicious domain, exploit file, or campaign-specific IOC should be assumed.

Patched desktop versions are Chrome 153.0.8010.36 for Linux, 153.0.8010.36/.37 for Windows and macOS. Chrome for Android 153.0.8010.36 contains the corresponding desktop security fixes unless otherwise noted. Because V8 processes attacker-controlled JavaScript from web content, this issue is relevant to ordinary enterprise browsing. Public reporting does not establish whether CVE-2026-87491 is used alone for code execution, chained with a sandbox escape, or limited to a specific targeted campaign.

References

Impacted Systems

Vendor/product: Google Chrome / Chromium V8. Component: V8 JavaScript engine. Vulnerability: CVE-2026-87491, out-of-bounds write in V8. Platforms: Windows, macOS, Linux; corresponding Chrome for Android release contains the desktop security fixes unless otherwise noted by Google. Fixed desktop versions: Linux 153.0.8010.36; Windows/macOS 153.0.8010.36/.37. Attack prerequisite: a user or browser process must process attacker-controlled content capable of reaching the vulnerable V8 code path; Google has not publicly disclosed the exploit path. Exploitation in the wild is confirmed. Chrome 152 and earlier stable builds should be treated as outdated until updated to the fixed Chrome 153 release.

Why this matters

Browsers are a broad enterprise attack surface and V8 memory-corruption vulnerabilities are frequently used as the first stage in exploitation chains. Even without public campaign details, confirmed exploitation justifies immediate version validation and focused browser post-exploitation hunting.

Criticality: High – Active exploitation with broad enterprise exposure.

Exploitation Status

Confirmed active exploitation. Google states that it is aware an exploit for CVE-2026-87491 exists in the wild. Google has not disclosed the threat actor, targeted organizations, malicious sites, exploit chain, or post-exploitation payload in the public advisory.

What this hunt looks for

Available Microsoft Sentinel telemetry can be reviewed for endpoints still exposed to CVE-2026-87491, Chrome spawning shells or living-off-the-land binaries, Chrome-created executable or script files, downloaded-file execution, unusual Chrome network destinations, and Windows Security Event process-creation fallbacks where the relevant endpoint telemetry is ingested.

Required logs

  • Microsoft Defender Vulnerability Management: DeviceTvmSoftwareVulnerabilities
  • Microsoft Defender XDR / Defender for Endpoint: DeviceProcessEvents, DeviceFileEvents, and DeviceNetworkEvents
  • Windows Security Events in SecurityEvent with Event ID 4688 and command-line auditing where available

First Pass – Devices Exposed to CVE-2026-87491

DeviceTvmSoftwareVulnerabilities
| where CveId =~ "CVE-2026-87491"
| project DeviceName, DeviceId, OSPlatform, OSVersion, OSArchitecture, CveId, VulnerabilitySeverityLevel, SoftwareVendor, SoftwareName, SoftwareVersion, RecommendedSecurityUpdate
| order by DeviceName asc

Chrome Spawning Shells or Living-off-the-Land Binaries

DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","rundll32.exe","regsvr32.exe","mshta.exe","wscript.exe","cscript.exe","certutil.exe","bitsadmin.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ProcessIntegrityLevel, SHA256
| order by TimeGenerated desc

Chrome-Created Executables and Scripts

DeviceFileEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where ActionType in~ ("FileCreated","FileRenamed")
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".ps1" or FileName endswith ".js" or FileName endswith ".vbs" or FileName endswith ".hta" or FileName endswith ".bat" or FileName endswith ".cmd"
| project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, SHA1, SHA256, InitiatingProcessCommandLine
| order by TimeGenerated desc

Chrome-Created File Executed Shortly After Creation

let CreatedByChrome = DeviceFileEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where ActionType == "FileCreated"
| where isnotempty(SHA1)
| project DeviceId, DeviceName, FileCreatedTime=TimeGenerated, FileName, FolderPath, SHA1;
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where isnotempty(SHA1)
| join kind=inner CreatedByChrome on DeviceId, SHA1
| where TimeGenerated between (FileCreatedTime .. FileCreatedTime + 30m)
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA1
| order by TimeGenerated desc

New Chrome Network Destinations Compared With Baseline

let Baseline = DeviceNetworkEvents
| where TimeGenerated between (ago(30d) .. ago(2d))
| where InitiatingProcessFileName =~ "chrome.exe"
| summarize by DeviceId, RemoteUrl, RemoteIP;
DeviceNetworkEvents
| where TimeGenerated > ago(2d)
| where InitiatingProcessFileName =~ "chrome.exe"
| join kind=leftanti Baseline on DeviceId, RemoteUrl, RemoteIP
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, RemotePort, Protocol, InitiatingProcessCommandLine
| order by TimeGenerated desc

Chrome Network Activity Followed by Suspicious Child Process

let ChromeNet = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "chrome.exe"
| project DeviceId, DeviceName, NetTime=TimeGenerated, RemoteUrl, RemoteIP;
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","rundll32.exe","regsvr32.exe","mshta.exe","wscript.exe","cscript.exe")
| join kind=inner ChromeNet on DeviceId
| where TimeGenerated between (NetTime .. NetTime + 10m)
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, RemoteUrl, RemoteIP, NetTime
| order by TimeGenerated desc

Windows SecurityEvent Fallback for Suspicious Chrome Children

SecurityEvent
| where TimeGenerated > ago(14d)
| where EventID == 4688
| where ParentProcessName endswith @"\chrome.exe"
| where NewProcessName has_any (@"\cmd.exe",@"\powershell.exe",@"\pwsh.exe",@"\rundll32.exe",@"\regsvr32.exe",@"\mshta.exe",@"\wscript.exe",@"\cscript.exe")
| project TimeGenerated, Computer, SubjectUserName, ParentProcessName, NewProcessName, CommandLine
| order by TimeGenerated desc

Detection Notes

The vulnerability-inventory query is the strongest first pass when Defender Vulnerability Management is available. Google has intentionally withheld exploit details, so the behavioral queries focus on common browser post-exploitation outcomes and are not CVE-specific signatures. Chrome legitimately creates files and connects to many new destinations; those hunts require reputation, user, and process-tree context. Browser child shells are much higher signal than new-domain activity alone. The downloaded-file execution join can miss activity when SHA1 is not populated. SecurityEvent 4688 requires process-creation auditing and command-line logging.