Source: cisa.gov
A critical out-of-bounds write vulnerability has been identified in Google Chromium's V8 JavaScript engine, tracked as CVE-2026-87491. The flaw allows remote attackers to execute arbitrary code within the sandbox by luring victims to a specially crafted HTML page. The vulnerability affects multiple Chromium-based browsers including Google Chrome, Microsoft Edge, and Opera. CISA has flagged this vulnerability under BOD 26-04, which prioritizes security updates based on risk. Forensic triage requirements have also been outlined in CISA's implementation guidance for BOD 26-04. Google has released a stable channel desktop update addressing this vulnerability. The vulnerability is rated as high severity due to its potential for remote code execution. Organizations using Chromium-based browsers are urged to apply patches immediately.
