Google Chrome & Chromium V8 Engine (Windows, macOS, Linux, Android) While vendor triage classified this vulnerability as Medium severity due to renderer sandbox constraints, Hermes elevates CVE-2026-87491 to 94 (CRITICAL). CISA added this zero-day to the KEV catalog on September 9, 2026, confirming targeted in-the-wild exploitation. Furthermore, autonomous AI agents and developer pipelines increasingly run headless Chromium instances for web browsing, turning client-side memory corruption into an immediate host agent hijacking vector.
Chromium V8 Engine & Headless Agent Browser Automation Autonomous agents equipped with browser tools (e.g., Playwright, Puppeteer, browser-use) navigate external, untrusted web destinations without human validation. Exploitation of CVE-2026-87491 allows malicious webpages to compromise the browser process, hijack the agent's active sessions, and execute arbitrary commands across connected host tools.
Software platform affected by security vulnerabilities and agentic attack patterns.
“Confirmed security vulnerability in Google Chromium / V8 Engine documented in Hermes dossier.”
Cascading multi-stage attack chaining context injection, autonomous loop planning, and un-sandboxed execution sinks to achieve persistent root shell compromise on host machines.
“CVE-2026-87491 weaponizes the agentic attack pattern formalized under AAP-007.”
Adversary embeds covert payload instructions into retrieved external data (web pages, repositories, emails) that subvert model planning when parsed by autonomous agents.
“CVE-2026-87491 weaponizes the agentic attack pattern formalized under AAP-002.”
| Attribute | Technical Specification | Operational Impact |
|---|---|---|
| CVE Identifier | CVE-2026-87491 | Universal vulnerability identifier |
| Discoverer | Jihyeon Jeong (Compsec Lab, Seoul National University) | Bug bounty report ($2,500 reward) |
| CVSS v3.1 Score | 8.8 (High) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| FIRST EPSS Score | 0.29% (21.44th percentile) | Rapidly accelerating following KEV listing |
| CISA KEV Status | Added on September 9, 2026 | Mandatory remediation under BOD 26-04 |
| Vulnerable Component | Google Chromium V8 JavaScript & WebAssembly Engine | Memory management / ArrayBuffer backing store |
| Attack Vector | Remote Network (Malicious Webpage / Browser Automation) | Requires visiting crafted URL or agent crawl |
| Downstream Impact | Google Chrome, Edge, Brave, Opera, Electron, Node.js | Ubiquitous desktop & agent infrastructure |
The vulnerability affects all Chromium builds prior to version 153.0.8010.36:
153.0.8010.36 or later;153.0.8010.37 or later;The flaw is classified under CWE-787 (Out-of-bounds Write) inside the memory layout and array buffer indexing logic of the V8 JavaScript engine.
CVE-2026-87491 V8 Out-of-Bounds Write Exploitation Flow:
┌─────────────────────────────────────────────────────────────┐ │ 1. Victim Browser / Headless AI Agent │ └──────────────────────────────┬──────────────────────────────┘ │ Navigates to malicious webpage ▼ ┌─────────────────────────────────────────────────────────────┐ │ 2. Malicious HTML / JavaScript Execution in V8 │ │ • Allocates WebAssembly Memory / TypedArray │ │ • Triggers off-by-one or bound check elimination in JIT │ └──────────────────────────────┬──────────────────────────────┘ │ Out-of-bounds write past allocation boundary ▼ ┌─────────────────────────────────────────────────────────────┐ │ 3. V8 Isolate Heap Memory Corruption │ │ • Overwrites adjacent ArrayBuffer length or map pointer │ │ • Constructs addrof() & fakeobj() arbitrary R/W primitives│ └──────────────────────────────┬──────────────────────────────┘ │ Arbitrary code execution in renderer ▼ ┌─────────────────────────────────────────────────────────────┐ │ 4. Renderer Sandbox Compromise & Host Pivoting │ │ • Executes shellcode inside Chrome renderer sandbox │ │ • In agentic workflows: steals API keys & host tool pipes│ └─────────────────────────────────────────────────────────────┘In modern V8 architectures, memory allocations for TypedArrays and WebAssembly memory instances are partitioned within the V8 virtual memory cage (V8 Sandbox). During boundary check optimizations in the multi-tier JIT compilation pipeline, the engine performs range analysis to verify that indexed writes remain constrained to the backing store allocated buffer.
In vulnerable builds, a flaw in the index validation routine enables an attacker-controlled calculation to bypass the boundary check. An out-of-bounds write operation transfers controlled byte sequences past the allocated buffer bounds into adjacent heap structures.
byte_length and backing_store pointer of an immediately adjacent ArrayBuffer object on the heap.ArrayBuffer size to 0xFFFFFFFF (4 GB) or pointing its backing store to arbitrary memory addresses, the attacker constructs reliable read64() and write64() primitives.Threat actors exploit CVE-2026-87491 through targeted watering hole campaigns and spear-phishing emails delivering links to weaponized web servers. In state-aligned operations, the renderer code execution primitive is chained with a secondary privilege escalation or sandbox escape zero-day (targeting the Windows kernel or Chrome broker process) to execute malware outside the sandbox.
Modern autonomous AI systems frequently employ headless browser toolkits (such as Playwright, Puppeteer, or custom browser agents) to:
When an autonomous agent navigates to an adversary-controlled page during an automated workflow:
--no-sandbox or --disable-setuid-sandbox in Docker containers), renderer RCE immediately results in full host container compromise, mirroring the cascading risks documented in AAP-007: Autonomous Cascading RCE.Investigating systems suspected of encountering CVE-2026-87491 exploitation requires examining browser crash dumps and abnormal child processes:
# 1. Inspect Linux / macOS Chrome crash logsls -la ~/.config/google-chrome/Crashpad/reports/minidump_stackwalk ~/.config/google-chrome/Crashpad/reports/*.dmp
# 2. Check for anomalous child processes spawned by browser processes (Linux)ps -ef | grep -E "(chrome|chromium|electron)" | grep -v "type="
# 3. Detect --no-sandbox flags in containerized agent configurationsgrep -rn "no-sandbox" /etc/docker/ /var/lib/docker/ /home/Process & Execution Artifacts
STATUS_ACCESS_VIOLATION 0xC0000005 on Windows or SIGSEGV on Linux).chrome.exe, msedge.exe, or headless browser instances spawning interactive shells (cmd.exe, powershell.exe, /bin/sh, /bin/bash).Filesystem & Memory Indicators
.dmp minidumps generated concurrently with web browsing activity.%TEMP%, /tmp/).title: Suspicious Child Process Spawned by Chrome or Chromium Engineid: 3e8291a4-9214-41d9-8174-bc41f92e1058status: stabledescription: Detects suspicious interactive shells or scripting binaries spawned directly by Google Chrome or Chromium-based processes, indicating renderer sandbox escape or exploit execution.references: - https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html - https://www.cisa.gov/known-exploited-vulnerabilities-catalogauthor: Hermes Codex Threat Intelligencedate: 2026-09-09tags: - attack.execution - attack.t1203 - attack.t1059 - cve.2026-87491logsource: category: process_creation product: windowsdetection: selection: ParentImage|endswith: - '\chrome.exe' - '\msedge.exe' - '\brave.exe' - '\opera.exe' Image|endswith: - '\cmd.exe' - '\powershell.exe' - '\pwsh.exe' - '\wscript.exe' - '\cscript.exe' - '\rundll32.exe' condition: selectionfalsepositives: - Rare administrative developer automation tools with explicit shell invoking.level: criticalrule Exploit_Chromium_V8_OOB_Write_Harness { meta: description = "Detects JavaScript memory spraying and ArrayBuffer backing store manipulation patterns characteristic of V8 out-of-bounds write exploits" author = "Hermes Codex AI Security Laboratory" date = "2026-09-09" reference = "CVE-2026-87491" strings: $wasm_magic = { 00 61 73 6D } $str_arrbuf = "ArrayBuffer" ascii $str_dataview = "DataView" ascii $s_addrof = /function\s+(addrof|addr_of|get_addr)\s*\(/ ascii $s_fakeobj = /function\s+(fakeobj|fake_obj)\s*\(/ ascii $s_spray = /for\s*\(\s*(var|let)\s+i\s*=\s*0;\s*i\s*<\s*(10000|0x10000)/ ascii condition: (uint32(0) == 0x6D736100 or all of ($str_*)) and (any of ($s_addrof, $s_fakeobj)) and $s_spray}// Hunt for anomalous process execution spawned by browser runtimesDeviceProcessEvents| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "brave.exe", "chromium.exe")| where FileName in~ ("cmd.exe", "powershell.exe", "whoami.exe", "net.exe", "curl.exe")| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName| sort by TimeGenerated descDeploy Google Chrome Stable Milestone 153:
Update Google Chrome across all endpoints:
153.0.8010.36 or later;153.0.8010.37 or later.Patch Chromium Derivatives & Electron Tooling:
Ensure Microsoft Edge, Brave, Opera, and developer desktop applications (Cursor, VS Code, Slack) are upgraded to builds incorporating Chromium 153 security fixes.
Harden AI Agent Browser Tool Configurations:
Review autonomous agent browser launcher configurations:
--no-sandbox: Never deploy headless Chrome with --no-sandbox or --disable-web-security flags in automated environments;CAP_SYS_ADMIN capabilities;Audit Agent Interaction Logs:
Inspect agent execution histories to identify any automated browsing sessions that terminated with unexpected renderer crashes or access violations.