CVE-2026-87491

An out-of-bounds write flaw in Google Chromium V8 lets remote attackers execute arbitrary code inside the browser sandbox via a crafted HTML page.

This vulnerability enables remote code execution within the browser sandbox, allowing attackers to bypass isolation and potentially access sensitive data or deploy malware. DIB organizations must ensure all Chromium-based browsers are patched immediately, as unpatched instances remain vulnerable to exploitation in the wild. The failure is avoidable through timely patch management and highlights the risk of relying on widely deployed software with known, unpatched CVEs.

Shame score — A critical RCE vulnerability in a foundational browser engine was actively exploited in the wild (KEV) and linked to ransomware campaigns, demonstrating severe negligence in patching and exposure.