CISA added CVE-2026-87491 to the Known Exploited Vulnerabilities catalog on September 9, 2026 with a September 23 deadline, citing a Chrome release note whose security section has not been written yet.
What happened
Google published the stable channel update for desktop Chrome 153.0.8010.36 on Tuesday, September 8, 2026 — 153.0.8010.36 for Linux, and 153.0.8010.36 and .37 for Windows and Mac. Where a Chrome release note normally carries its “Security Fixes and Rewards” table, this one carries a single line: “Security changes to be updated shortly.” As retrieved for this story on the afternoon of September 9, that line was still there. No CVE list, no severity labels, no reporter credits, and no sentence about an exploit existing in the wild.
Early on September 9, 2026, NVD published CVE-2026-87491. Google is the CNA, and the description Google supplied reads: “Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)”
The record is in “Received” status. It carries CWE-787 and no CVSS score of any kind — not a Google vector, not a NIST vector. Its two references are the September 8 release note and Chromium issue 543557673, which requires a sign-in to read.
Later the same day, CISA added the CVE to the KEV catalog under the name “Google Chromium V8 Out of Bounds Write Vulnerability,” with dateAdded of 2026-09-09 and dueDate of 2026-09-23 — a 14-day window. forensicTriage is No, so the obligation is remediation without a mandatory compromise assessment. knownRansomwareCampaignUse is Unknown. CISA’s description adds the scope the CVE record leaves implicit: the flaw “could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.”
The single vendor link in CISA’s entry is the September 8 release note — the one with no security section.
Why it matters
Two things on this record do not fit together, and both are worth an operator’s attention before the coverage settles into a shape that hides them.
The first is the severity word. Google’s own annotation on the CVE it authored says “Chromium security severity: Medium.” A US federal agency has, within a day, determined the same flaw is being exploited and put it on a two-week clock for every civilian agency. Medium-severity entries in the KEV catalog are not unheard of — this publication has covered one before, where a mid-scored flaw yielded root — but they are rare enough to be a signal rather than noise. Chromium’s severity scale measures the security impact of the bug on its own terms, and a V8 out-of-bounds write that stays inside the renderer sandbox is, by that scale, a lesser thing than one that escapes it. Exploitation in the wild does not change the technical reach of a bug. It does change the calculus for anyone deciding what to push this week, and a “Medium” in a patch-prioritization queue will not survive contact with a KEV listing that says the bug is already in use.
The practical consequence is concrete. Organizations that gate browser rollouts on vendor severity, and there are many, will have looked at “Medium” and scheduled it behind whatever else is queued. The KEV entry says that decision is wrong for this CVE. Anyone whose patch policy reads severity labels rather than exploitation status should check what their tooling did with this one over the past 24 hours.
The second is that Google has not published the security material for this release. A release note that says “Security changes to be updated shortly” is a normal, temporary state — Chrome routinely ships the binary before the write-up, holding fix details back while updates propagate. What is not normal is that the write-up is still missing after a federal agency has cited that exact page as the vendor reference for an exploited vulnerability. CISA’s KEV entry points a reader at a page that does not mention the CVE.
Anyone following the chain the way it is meant to be followed — catalog entry to vendor advisory — arrives with nothing. The information that exists in public is split across a CVE record with no score, a bug tracker that requires a sign-in, and an agency description that is currently the only public statement tying this identifier to real-world exploitation. Secondary coverage has filled the gap in the meantime, describing Chrome 153 as carrying 230 security fixes and this as the seventh exploited Chrome zero-day of 2026. Neither figure appears on Google’s page as retrieved, and neither is verifiable against a primary source today. They may well be right. They are not, at this hour, checkable.
There is also a cadence worth noting. CISA added a different V8 flaw, CVE-2026-85046, to the catalog on September 4, 2026, with a September 18 deadline. That entry was covered here. Five days later a second V8 out-of-bounds write is in the catalog with a September 23 deadline. Two Chromium engine bugs listed as exploited inside one week is a pattern that argues for treating browser updates as an operational cadence rather than a monthly chore, whatever severity word the vendor attaches to any individual one.
What to do
Update desktop Chrome to 153.0.8010.36 or later on Linux, and 153.0.8010.36 or .37 or later on Windows and Mac. Verify the rollout rather than trusting the update channel: managed fleets frequently have a meaningful tail of machines that have not restarted, and a Chrome that has downloaded a fix but not relaunched is not a patched Chrome.
Extend the check past Chrome. CISA names Microsoft Edge and Opera explicitly and says the list is not exhaustive; anything shipping the affected V8 needs its own vendor’s build, on its own schedule, and those schedules do not line up with Google’s. Electron-based desktop applications inherit Chromium too, and typically lag furthest behind.
Federal civilian agencies have until Wednesday, September 23, 2026. The entry does not carry the forensic-triage obligation, so remediation discharges it. For everyone else, the useful posture is to ignore the “Medium” label on this one and treat it at the priority the KEV listing implies. If your patch tooling ingests vendor severity to set deadlines, this CVE is a good test case for whether that logic has an exploitation override in it.
Sourcing note
Checked: Google’s Chrome Releases post for the stable channel desktop update of September 8, 2026, retrieved on the afternoon of September 9, 2026, for the version numbers and the state of its security section; the NVD record for CVE-2026-87491 for the description, status, weakness, absence of any CVSS score, and references; and CISA’s KEV catalog entry for the dates, deadline, flags, and product scope.
cisa.gov returns 403 to automated fetching, so the KEV entry was read from cisagov/kev-data on GitHub, which CISA maintains as a mirror of the cisa.gov/kev data files. The file used is catalog version 2026.09.09, dateReleased 2026-09-09T19:00:50.2591Z.
Could not reach: Chromium issue 543557673, which requires authentication, and the Chrome Releases label index, which is disallowed to automated retrieval. If Google has published the security section for this release at another URL, it was not found.
Unresolved: whether Google will revise the “Medium” label now that the flaw is listed as exploited; when the release note’s security section will appear; who reported the bug and when; and what the exploitation looked like, which CISA does not publish. The widely reported figures of 230 fixes in Chrome 153 and a seventh Chrome zero-day for 2026 come from secondary coverage and are not confirmed against a primary source here.