Critical Analysis: CVE-2026-87491 - Google Chromium V8 Out of Bounds Write Vulnerability... — September 11, 2026

Published 11 Sep 2026 · vulnerability management, CVE analysis, threat intelligence, security operations, cybersecurity news

AGMP Partners Alright team, let’s talk about CVE-2026-87491, a critical out-of-bounds write vulnerability in Google Chromium's V8 JavaScript engine that dropped this morning, September 11, 2026. This isn't just another patch; it's a significant memory corruption bug that demands immediate attention. As senior analysts, we’ve seen countless V8 bugs, but the specific primitive this one offers makes it particularly dangerous, pushing it straight into our priority patching and threat hunting cycles. The CVSSv3.1 score is a daunting 9.8 (Critical), reflecting its network exploitability, low complexity, and high impact on confidentiality, integrity, and availability. We’re looking at a browser-based remote code execution (RCE) vector here, which, as we all know, is the gold standard for initial access for most sophisticated threat actors. Initial Discovery and Context This vulnerability was in