CVE-2026-87491 · Chromium V8 Out-of-Bounds Write via Turboshaft Compiler Effect…

01 · The Real Story

A compiler that trusts a WebAssembly helper not to write is the unlocked side door four espionage teams walked through

CVE-2026-87491 is an out-of-bounds write in V8's Turboshaft optimizing compiler, affecting all Chromium-based browsers — Google Chrome prior to 153.0.8010.36, Microsoft Edge prior to 152.0.4191.65, and Opera. The Turboshaft compiler's descriptor for WasmGetOwnProperty declares the operation as non-throwing and memory-read-only, but the underlying Torque built-in calls GetPropertyWithReceiver, which can invoke arbitrary JavaScript when it encounters an accessor descriptor. Because the compiler believes no write can occur, Late Load Elimination retains a stale WasmDispatchTable tuple across the accessor callback, and a subsequent call_indirect produces a type-confused dispatch that writes outside intended memory bounds. Exploitation gives an attacker arbitrary code execution within Chrome's V8 sandbox. Reported by Jihyeon Jeong of Compsec Lab at Seoul National University on August 6, 2026, Google awarded a $2,500 bounty and shipped the fix on September 8.

The NVD rates this HIGH 8.8, while Google's own Chrome severity label is only Medium — a disconnect that undersells the real-world risk by orders of magnitude. Volexity and Proofpoint documented four distinct Chinese APT groups — UTA0560, JungleBamboo (APT31/Violet Typhoon), UNK_LateNight, and UNK_DoubleCheck — weaponizing this bug as the V8 sandbox-escape link in the BlueMoon exploit chain (CVE-2026-85046 → CVE-2026-87491 → CVE-2026-85880) to achieve kernel-level code execution on Windows endpoints. Targets included US-based NGOs, aerospace firms, and Vietnamese manufacturing. The CISA KEV deadline of September 23 has already passed. When a vulnerability is the hinge in a nation-state full-chain zero-day that has been deployed against at least four target verticals, HIGH 8.8 is not an adequate signal — this is a CRITICAL-priority fleet action.

"Nation-state APTs chain this V8 bug for full system compromise — patch Chrome fleet now"

02 · The Attack Path

5 steps from start to impact.

STEP 01

Spear-phishing lure delivers malicious URL

The attacker sends a targeted phishing email containing a link to an attacker-controlled or compromised website hosting the exploit page. Volexity observed UTA0560 using donation-themed lures against NGO staff and JungleBamboo targeting named individuals at multiple organizations. No file attachment is needed — a single click is sufficient.

Conditions required:

Victim uses a Chromium-based browser below the patched version
Victim clicks or is redirected to a malicious URL

Where this breaks in practice:

Enterprise email gateways with URL reputation and sandboxing may block the lure
Security-aware users may recognize spear-phishing attempts

Detection/coverage: Email gateway URL detonation; known IOC domains: cloud.shinewrist[.]net, ocr.opusaccel[.]top, gitprogram[.]com, msbenefit[.]com

STEP 02

V8 type confusion gains heap read/write (CVE-2026-85046)

The exploit page first triggers a separate V8 type-confusion vulnerability (CVE-2026-85046) to achieve arbitrary read/write primitives within the V8 heap sandbox. This is the memory corruption foundation that enables the next stage. The exploit is encoded in JavaScript served inline or via a WebAssembly module.

Conditions required:

Browser has not patched CVE-2026-85046
JavaScript execution is enabled

Where this breaks in practice:

Chrome's V8 sandbox (memory cage) contains damage to the V8 heap region
Site isolation limits cross-origin reads

Detection/coverage: Nessus plugin google_chrome_153_0_8010_36.nasl and MACOSX_GOOGLE_CHROME_153_0_8010_36.NASL detect unpatched Chrome versions

STEP 03

Turboshaft misoptimization escapes V8 sandbox (CVE-2026-87491)

With heap read/write established, the exploit forges a wasm_exception_tag_symbol accessor descriptor, places the accessor object in an exported exnref table, and triggers WasmGetOwnProperty through a throw_ref / WebAssembly.JSTag catch sequence. The Turboshaft compiler's stale load assumption produces a type-confused call_indirect dispatch that writes out-of-bounds, escaping the V8 memory cage into the full renderer process address space. This is the core bug — CVE-2026-87491.

Conditions required:

CVE-2026-85046 has succeeded (arbitrary V8 heap r/w)
WebAssembly is enabled (default in all Chromium browsers)

Where this breaks in practice:

Exploit requires precise heap layout — fragile across V8 versions, but the APT groups clearly solved this
V8 sandbox (memory cage) is the primary mitigation this bug defeats

Detection/coverage: Renderer crash telemetry may show anomalous EXCEPTION_ACCESS_VIOLATION in wasm stacks; CrowdStrike Falcon and SentinelOne report behavioral detection for V8 sandbox escape primitives

STEP 04

Windows kernel exploit escapes OS sandbox (CVE-2026-85880)

With code execution in the renderer process (outside the V8 cage but still inside Chrome's OS-level sandbox), the exploit triggers a Windows kernel vulnerability in RtlpCreateServerAcl (CVE-2026-85880) to escape the renderer sandbox entirely and achieve SYSTEM-level code execution on the host. This completes the full chain from browser tab to kernel.

Conditions required:

Target is running Windows
CVE-2026-85880 is unpatched
Chrome renderer sandbox is the containment boundary

Where this breaks in practice:

Linux and macOS endpoints are not affected by this chain stage
Windows hosts with the September 2026 kernel patch break the chain here

Detection/coverage: Windows Defender Exploit Guard / Attack Surface Reduction rules for child process creation from renderer; EDR behavioral detection for anomalous msiexec.exe spawned from Chrome

STEP 05

Post-exploitation payload deployment

With SYSTEM access, the threat actors deploy their operational tooling. UTA0560 drops GRIMWEDGE, a compact JScript backdoor (~250 lines) executed via msiexec.exe supporting recon, file ops, and command execution. JungleBamboo installs SUPERSTOMP loader followed by LONGTALE, a malicious Chrome extension that exfiltrates cookies, keystrokes, screenshots, and active sessions. UNK_LateNight deploys ShadowPad. All implants establish C2 over HTTPS to actor-controlled infrastructure.

Conditions required:

Full chain has succeeded (steps 1-4)
Outbound HTTPS is permitted to C2 domains

Where this breaks in practice:

EDR/XDR should detect GRIMWEDGE's JScript execution pattern and LONGTALE's extension side-loading
Network monitoring may flag C2 beaconing to newly registered domains

Detection/coverage: YARA rules for GRIMWEDGE JScript backdoor; Chrome enterprise policy audit for unauthorized extensions; DNS/proxy logs for IOC domains 206.166.251[.]164

03 · Compensating Control

CRITICAL 9.3→IGNORE 0.0

SEVERITY REDUCED

Force-update all Chromium browsers via enterprise policy immediately — Push Chrome ≥ 153.0.8010.36 and Edge ≥ 152.0.4191.65 via GPO (GoogleUpdate ADMX), Intune, SCCM, or browser management platform. This is the definitive fix. Given the CRITICAL reassessment and active KEV exploitation, deploy within 3 days per the noisgate mitigation SLA. Set TargetVersionPrefix and Update{default} policies to enforce minimum versions and prevent rollback.

CRITICAL 9.3→MEDIUM 5.5

SEVERITY REDUCED

Patch Windows kernel CVE-2026-85880 to break the chain — Even if browser patching is delayed, applying the September 2026 Windows cumulative update removes the OS sandbox-escape stage. This breaks the BlueMoon chain at step 4, confining exploitation to the renderer sandbox. Deploy within 3 days to degrade chain viability while browser updates propagate.

CRITICAL 9.3→HIGH 8.0

SEVERITY REDUCED

Block known BlueMoon IOC domains and IPs at DNS/proxy — Sinkhole or block cloud.shinewrist[.]net, ocr.opusaccel[.]top, gitprogram[.]com, msbenefit[.]com, and IP 206.166.251[.]164 at your DNS resolver and web proxy. This disrupts C2 for the documented campaigns but does not prevent initial exploitation or future campaigns using fresh infrastructure. Implement within 24 hours.

CRITICAL 9.3→HIGH 7.5

SEVERITY REDUCED

Enable Chrome enterprise policy to disable untrusted extensions — Set ExtensionInstallBlocklist to * and ExtensionInstallAllowlist to your approved set via GPO or Intune. This prevents the LONGTALE malicious extension installation used by JungleBamboo/APT31 even if the exploit chain succeeds. Deploy within 3 days.

CRITICAL 9.3→HIGH 7.0

SEVERITY REDUCED

Deploy ASR rules blocking child process creation from browser renderers — Windows Defender Attack Surface Reduction rule d4f940ab-401b-4efc-aadc-ad5f3c50688a (Block Office/browser child processes) limits post-exploitation payload execution. Configure via Intune or GPO. This degrades step 5 of the chain but a sophisticated attacker may use alternative injection techniques. Deploy within 3 days.

What doesn't work

Chrome Site Isolation — already enabled by default; it prevents cross-origin data reads but does not stop the V8 OOB write or sandbox escape, which operate within a single renderer process.
Web Application Firewalls (WAF) — the exploit is delivered via client-side browser navigation to an attacker-controlled site, not through a protected web application. WAFs inspect inbound requests to your servers, not outbound browsing.
Network-level IDS/IPS without TLS inspection — the exploit payload is served over HTTPS. Without TLS termination and deep packet inspection, network sensors cannot see the exploit content. Even with inspection, the JavaScript/Wasm payload is heavily obfuscated.
Disabling WebAssembly via enterprise policy — while the exploit leverages Wasm built-ins, Chrome does not offer a granular policy to disable WebAssembly without breaking legitimate web applications. The --no-wasm flag is not supported in enterprise policy templates.

04 · Intelligence Metadata

The supporting signals.

In-the-Wild Status	Confirmed active exploitation. Google acknowledged ITW exploitation on Sep 8, 2026. Volexity documented four Chinese APT groups — UTA0560, JungleBamboo (APT31), UNK_LateNight, UNK_DoubleCheck — using CVE-2026-87491 as the V8 sandbox-escape component of the BlueMoon chain beginning Sep 1, 2026. Targets included US NGOs, aerospace, and Vietnamese manufacturing (Volexity).
PoC Availability	No public PoC. No entries on pocindex.io, GitHub, ExploitDB, or Metasploit as of Oct 8, 2026. The exploit is nation-state grade — privately held by Chinese CNE groups. Google has restricted Chromium bug #543557673 details.
EPSS	0.03142 (3.14%) — approximately 92nd percentile. High for a browser CVE; the model likely reflects KEV listing and confirmed exploitation signals.
CISA KEV	Listed Sep 9, 2026. Federal remediation deadline: Sep 23, 2026 (PAST DUE as of today). Added alongside three other CVEs in the same batch.
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` — Network-reachable, low complexity, no privileges, user interaction (page visit), unchanged scope. The S:U is technically correct for the isolated bug (sandbox-contained) but misleading given the documented chain context where scope changes twice.
Affected Versions	Google Chrome < 153.0.8010.36 (all platforms), Microsoft Edge < 152.0.4191.65, Opera and all Chromium-based browsers using V8 prior to the upstream fix. Note: Google internally rates the Chrome severity as Medium, while NVD assigns HIGH 8.8.
Fixed Versions	Chrome 153.0.8010.36 (Linux), 153.0.8010.36/.37 (Windows/macOS). Edge 152.0.4191.65. Chromium source patched Aug 4, 2026 — a 35-day patch gap existed before the stable release.
Scanning / Exposure	Nessus plugins available: `google_chrome_153_0_8010_36.nasl` (Windows), `MACOSX_GOOGLE_CHROME_153_0_8010_36.NASL` (macOS). Browser-side vulnerability — not directly observable via Shodan/Censys/GreyNoise (no server-side indicator). Enterprise fleet visibility requires credentialed endpoint scans or browser management telemetry.
Disclosure Timeline	Aug 6, 2026: Reported by Jihyeon Jeong (Compsec Lab, Seoul National University). Aug 4, 2026: Fix committed to Chromium source. Sep 1, 2026: In-the-wild exploitation detected by Volexity. Sep 8, 2026: Chrome 153 stable released. Sep 9, 2026: CISA KEV added.
Reporting Researcher	Jihyeon Jeong, Compsec Lab, Seoul National University. Google awarded a $2,500 bug bounty. The 35-day gap between source fix (Aug 4) and stable release (Sep 8) was exploited by threat actors who monitored the Chromium commit log — the classic n-day-as-zero-day patch gap.

Sources.

05 · The Call

Final Verdict

↑ UPGRADED to CRITICAL (9.3/10)

Why this verdict

Active multi-group nation-state exploitation: Four Chinese APT groups (UTA0560, JungleBamboo/APT31, UNK_LateNight, UNK_DoubleCheck) independently weaponized this CVE as a zero-day before the patch shipped. This is not theoretical risk — it is confirmed, ongoing, targeted espionage with named malware families (GRIMWEDGE, LONGTALE, ShadowPad).
Critical chain link — not a standalone bug: CVE-2026-87491 is the V8 sandbox-escape stage of the BlueMoon chain. Without it, the chain from CVE-2026-85046 (type confusion) cannot progress past the V8 memory cage to reach the Windows kernel escape (CVE-2026-85880). Patching this CVE alone breaks the entire kill chain. Its strategic position in the chain demands CRITICAL treatment.
Near-zero friction to initial exploitation: AV:N/AC:L/PR:N/UI:R — the only user action required is visiting a page. Spear-phishing email with a single link is the demonstrated delivery vector. No authentication, no file download, no macro enable, no user prompt. Enterprise email gateways are the sole pre-click friction point, and the APTs clearly bypassed them.
Ubiquitous attack surface: Chrome and Chromium-based browsers are installed on effectively every managed endpoint in a 10,000-host enterprise. The installed base is not a niche product — it is the universal application. Every endpoint with an unpatched browser is a viable entry point.
Role multiplier: Chrome runs on workstations used by domain administrators, PAM operators, CI/CD engineers, and SOC analysts. The BlueMoon chain achieves SYSTEM on Windows — if the compromised endpoint has cached Kerberos TGTs, RDP sessions, or VPN tokens, the blast radius extends from host → domain → fleet. An admin workstation compromise via this chain yields the same outcome as a DC exploit: domain takeover. Admin workstations represent well above 1% of Chrome installs in any enterprise, establishing a HIGH floor. The confirmed use of ShadowPad by UNK_LateNight (a known lateral-movement and domain-persistence toolkit) confirms this blast radius is not theoretical.
CISA KEV deadline is PAST DUE: The Sep 23, 2026 federal remediation deadline has elapsed. Any unpatched Chromium browsers in the fleet represent a compliance gap on top of the technical risk.

Why not higher?

A 10.0 would require no user interaction and an uncontained scope in the standalone CVE. CVE-2026-87491 alone achieves code execution *inside* the V8 sandbox — full system compromise requires two additional unpatched vulnerabilities (CVE-2026-85046 and CVE-2026-85880). Chrome auto-update covers the consumer population, and the patch has been available for 30 days, reducing the window for opportunistic exploitation. The 9.3 reflects that the chain is real and weaponized but not wormable.

Why not lower?

Downgrading to HIGH would ignore the confirmed active exploitation by four nation-state groups, the past-due KEV deadline, and the strategic role this CVE plays as the irreplaceable sandbox-escape link in a full chain to SYSTEM. The patch-gap exploitation pattern (source fix visible on Aug 4, stable release on Sep 8, first attacks on Sep 1) demonstrates that threat actors specifically targeted this CVE window. Any enterprise that has not yet force-updated browsers is operating with a known-exploited, weaponized vulnerability on every endpoint.

06 · Verification

Crowdsourced verification payload.

Run on each target Windows endpoint (or push via SCCM/Intune script deployment). Requires standard user privileges — no elevation needed. Invoke: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-87491.ps1. Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN.

noisgate-verify.ps1

POWERSHELLREAD-ONLYSAFE

#Requires -Version 5.1
<#
.SYNOPSIS
  CVE-2026-87491 checker — Chromium V8 OOB Write
.DESCRIPTION
  Reads Chrome and Edge versions from registry, compares
  against patched builds. Reports VULNERABLE / PATCHED / UNKNOWN.
.OUTPUTS
  Exit 0 = PATCHED | Exit 1 = VULNERABLE | Exit 2 = UNKNOWN
#>
$ErrorActionPreference = 'SilentlyContinue'
$patchedChrome = [version]'153.0.8010.36'
$patchedEdge   = [version]'152.0.4191.65'
$vuln  = $false
$found = $false

# --- Google Chrome ---
foreach ($k in @(
    'HKLM:\SOFTWARE\Google\Chrome\BLBeacon',
    'HKLM:\SOFTWARE\WOW6432Node\Google\Chrome\BLBeacon',
    'HKCU:\SOFTWARE\Google\Chrome\BLBeacon'
)) {
    $v = (Get-ItemProperty $k).version
    if ($v) {
        $found = $true
        if ([version]$v -lt $patchedChrome) {
            Write-Output "VULNERABLE - Chrome $v < $patchedChrome"
            $vuln = $true
        } else {
            Write-Output "PATCHED    - Chrome $v"
        }
        break
    }
}

# --- Microsoft Edge ---
foreach ($k in @(
    'HKLM:\SOFTWARE\Microsoft\Edge\BLBeacon',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Edge\BLBeacon',
    'HKCU:\SOFTWARE\Microsoft\Edge\BLBeacon'
)) {
    $v = (Get-ItemProperty $k).version
    if ($v) {
        $found = $true
        if ([version]$v -lt $patchedEdge) {
            Write-Output "VULNERABLE - Edge $v < $patchedEdge"
            $vuln = $true
        } else {
            Write-Output "PATCHED    - Edge $v"
        }
        break
    }
}

if (-not $found) {
    Write-Output 'UNKNOWN - No Chromium browser found in registry'
    exit 2
}
if ($vuln) { exit 1 } else { exit 0 }