Loading vulnerability…
V8 Out-of-Bounds Write and V8 Sandbox Escape in Google Chrome
CVE-2026-87491 is an out-of-bounds write vulnerability in the V8 JavaScript and WebAssembly engine affecting Google Chrome before version 153.0.8010.36 and Chromium-based browsers incorporating vulnerable V8 code. A remote attacker can trigger memory corruption through a crafted HTML page, enabling arbitrary code execution within the browser renderer sandbox. In the BlueMoon exploit chain, attackers use the flaw after CVE-2026-85046 supplies read/write access within the V8 heap cage. By corrupting WebAssembly metadata and replacing compiled function code with shellcode, the exploit bypasses the V8 sandbox. This V8 sandbox bypass does not itself establish escape from the browser renderer's operating-system sandbox. The vulnerability has been exploited in the wild.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits attacker-controlled native code execution within the browser renderer process and bypass of V8's internal memory-isolation boundary. The renderer's operating-system sandbox remains a separate security boundary. BlueMoon combines this vulnerability with CVE-2026-85046 and Windows privilege-escalation vulnerability CVE-2026-85880 to escape the renderer sandbox and execute malware on the endpoint; those broader outcomes depend on the additional vulnerabilities.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified. Until updates are deployed, restrict use of affected browsers and exposure to untrusted web content, apply web and email filtering against exploit delivery, and retain browser sandboxing and endpoint protections. Monitor suspicious browser activity and investigate potentially compromised endpoints. These measures reduce exposure but do not replace patching.
Patch, then assume compromise.
Update Google Chrome to the latest supported release containing the fix. The baseline fixed release is 153.0.8010.36; platform-specific releases include 153.0.8010.36/.37 for Windows and macOS. For Debian stable trixie, upgrade Chromium to 153.0.8010.47-2~deb13u1 or later. Update other Chromium-based browsers using their vendors' applicable security releases rather than assuming Chrome version numbers apply. For endpoints exposed to BlueMoon, also patch the companion browser and Windows vulnerabilities and investigate for installed malware or persistence, which browser updates do not remove.
2 exploits validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
156 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.