NCSC-2026-0354 [1.00] [M/H] Kwetsbaarheid verholpen in Google Chrome
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Google heeft een zeroday-kwetsbaarheid verholpen in de V8 JavaScript engine van Google Chrome. Google meldt dat de kwetsbaarheid met kenmerk CVE-2026-87491 actief wordt misbruikt. Het betreft een out-of-bounds write in de V8-engine van Google Chrome, die voorkomt in versies vóór 153.0.8010.36. Een kwaadwillende kan een speciaal vervaardigde HTML-pagina gebruiken om de kwetsbaarheid te activeren en binnen de sandbox willekeurige code uit te voeren. De kwetsbaarheid wordt veroorzaakt door onjuiste bounds checking in het geheugenbeheer van V8, wat kan leiden tot geheugenbeschadiging. Succesvol misbruik kan daarnaast leiden tot toegang tot gegevens buiten de toegewezen geheugenbuffer, waardoor gevoelige informatie kan worden buitgemaakt of de browser kan crashen.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0354
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-87491Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 21% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-87491 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownexploitedGoogle Chrome Multiple Vulnerabilitieshkcert
- unknownexploitedGoogle security advisory (AV26-904)cccs
- highexploitedCISA Adds Four Known Exploited Vulnerabilities to Catalogcisa
- highexploitedCVE-2026-87491: Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to…nvd
- criticalexploitedCVE-2026-87491: Google Chromium V8 Out of Bounds Write Vulnerabilitycisa-kev
- unknownexploitedMultiples vulnérabilités dans Google Chrome (09 septembre 2026)cert-fr-avis
Recent advisories for Kwetsbaarheid verholpen in
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownNCSC-2026-0359 [1.00] [M/H] Kwetsbaarheid verholpen in Ivanti Endpoint Manager Mobilencsc-nl · 2026-09-09
- unknownNCSC-2026-0357 [1.00] [M/H] Kwetsbaarheid verholpen in Ivanti Sentryncsc-nl · 2026-09-09
- unknownexploitedNCSC-2026-0344 [1.00] [H/H] Kwetsbaarheid verholpen in Adobe Commerce en Magentoncsc-nl · 2026-09-08
- unknownexploitedNCSC-2026-0342 [1.00] [H/H] Kwetsbaarheid verholpen in N-central van N-ablencsc-nl · 2026-09-07
- unknownexploitedNCSC-2026-0336 [1.00] [M/H] Kwetsbaarheid verholpen in JFrog Artifactoryncsc-nl · 2026-09-02
- unknownexploitedNCSC-2026-0324 [1.00] [M/H] Kwetsbaarheid verholpen in Zimbra Collaboration Suitencsc-nl · 2026-08-23
More from NCSC-NL Advisories
- unknownNCSC-2026-0365 [1.00] [H/H] Kwetsbaarheden verholpen in Check Point VPN producten2026-09-10
- unknownNCSC-2026-0364 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Illustrator2026-09-09
- unknownNCSC-2026-0363 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Experience Manager2026-09-09
- unknownNCSC-2026-0362 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe ColdFusion2026-09-09
- unknownNCSC-2026-0361 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Commerce2026-09-09