CVE-2026-87491Active Exploitation(google / chrome)

CRITICALCVSS 8.8 · HIGHCISA KEV

Exploitation observed; activity peaked at 43 mentions and remains active

Immediate actions

Patch google chrome systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

google CVEs Back to dashboard

8.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-09-23. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Vendor / third-party advisories

https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html

Other references

Weakness type (CWE)

CWE-787

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

chrome

Threat summary

Active exploitation appears in 90 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
113 mentions across 23 observed days

What's happening

Active exploitation reported across 90 signals
Exploit tool or code specified in 11 signals
PoC mentioned or linked in 7 signals
Patch or workaround mentioned in 71 signals
Technical details provided in 75 signals
Disclosure: 6 classified signals
Peaked 22d ago at 43 mentions (2026-09-09); latest day: 1
113 total mentions across 23 days

Affected systems

Vendors

google

Products

chrome

Deep dive

Activity timeline113 mentions / 23d

Signal classification5 categories

Active Exploitation

6965.1%

Patch

2624.5%

Disclosure

65.7%

Exploit

32.8%

General

21.9%

Referenced assets103 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-09	43	Active Exploitation26Disclosure3Patch14
2026-09-10	21	Active Exploitation12Exploit1General1Patch7
2026-09-11	4	Active Exploitation2Patch2
2026-09-12	8	Active Exploitation5Exploit1General1Patch1
2026-09-13	1	Active Exploitation1
2026-09-14	6	Active Exploitation6
2026-09-15	5	Active Exploitation3Patch2
2026-09-16	1	Active Exploitation1
2026-09-17	2	Active Exploitation1
2026-09-18	2	Active Exploitation1Disclosure1
2026-09-20	1	Active Exploitation1
2026-09-21	4	Active Exploitation3Disclosure1
2026-09-22	1	Active Exploitation1
2026-09-23	2	Active Exploitation2
2026-09-27	1	Disclosure1
2026-09-28	2	Active Exploitation2
2026-10-01	1	Active Exploitation1
2026-10-05	2	Active Exploitation1Exploit1

Full discourse20 posts

The Hacker News@TheHackersNews45d
Active Exploitation
⚠️ ALERT - Google patched a new actively exploited Chrome V8 zero-day. CVE-2026-87491 lets crafted HTML execute arbitrary code inside Chrome’s sandbox. Google has not said how it’s being weaponized or who is behind it. Read: https://thehackernews.com/2026/09/chrome-v8-zero-day-exploited-in-wild.html
Post summary
A new Chrome V8 zero‑day (CVE‑2026‑87491) has been disclosed as actively exploited in the wild. Google has issued a patch, but the exact weaponization details remain unknown.
124731844338.9K
2.4M followersView on X
Zero Day Engineering@zerodayalpha39d
Patch
⚡️ 0-Day Alert: Chrome v8 RCE CVE-2026-87491: WasmGetOwnProperty builtin may invoke a getter from user's JavaScript, leading to OOBW. Patched in Chrome 153.0.8010.36/.37 https://intelligence.zerodayengineering.com/0-day-alert-cve-2026-87491/
Post summary
The post announces a Chrome 0-day vulnerability with technical details and explicitly provides patched Chrome versions. The primary takeaway is the availability of a patch rather than active exploitation, PoC, or named exploit tooling.
32401568610.8K
11.8K followersView on X
Volexity@Volexity45d
Active Exploitation
Earlier this month, @Volexity detected multiple Chinese threat actors launching attacks against its customers using chained 0-day exploits in Google Chrome (CVE-2026-85046 & CVE-2026-87491) and Microsoft Windows (CVE-2026-85880). Volexity observed threat actors it tracks as UTA0560 and JungleBamboo using variations of the same exploits to deliver different malware implants. These implants ranged from a JScript backdoor (GRIMWEDGE) to a fake Google Gemini Chrome extension (LONGTALE). Read the full analysis of the exploit chain and post-exploitation tradecraft here: https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/ #DFIR #threatintel
Post summary
Volexity reports ongoing attacks by Chinese threat actors using a chain of new 0‑day exploits in Chrome and Windows, indicating that CVE‑2026‑85046, CVE‑2026‑87491 and CVE‑2026‑85880 are being actively abused.
24911003713.7K
8.5K followersView on X
xvonfers@xvonfers45d
Disclosure
(CVE-2026-87491)[543557673][wasm][sandbox]OOBW, exploited ITW https://chromium.googlesource.com/v8/v8/+/36079c36283aaf3d0cee0797e46ddc278988f7f2 PoC: https://chromium.googlesource.com/v8/v8/+/36079c36283aaf3d0cee0797e46ddc278988f7f2/test/mjsunit/sandbox/regress/regress-543557673.js Reported by Jihyeon Jeong: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html https://t.co/XVNySg1aV5
Post summary
CVE-2026-87491 is a sandbox out-of-bounds write vulnerability in WebAssembly, disclosed with a PoC and a referenced patch update; no evidence of live exploitation.
0222936425.8K
5.0K followersView on X
Volexity@Volexity33d
Active Exploitation
Following @Volexity's September 9 blog post on two Chinese APT actors chaining 0-days in Chrome (CVE-2026-85046, CVE-2026-87491) & Windows (CVE-2026-85880), Volexity discovered another threat actor, UTA0565, had been using the same exploits on Sept 3-4, 2026, while they were still unpatched. UTA0565 used multiple fake websites, posing as media organizations and an NGO, to run a more customized version of the exploit framework than previously documented instances. The payload delivered was a new custom malware family, CLEANGULP, obfuscated using control flow flattening. Full details and IOCs can be found here: https://www.volexity.com/blog/2026/09/21/mind-the-patch-gap-part-2-fake-websites-used-to-deploy-chrome-windows-0-day-exploits/ #DFIR #threatintel
Post summary
The text reports active, in-the-wild exploitation of three zero-day vulnerabilities (two Chrome, one Windows) by threat actor UTA0565 in early September 2026, detailing the use of fake websites, a customized exploit framework, and a novel malware family (CLEANGULP).
330074266.4K
8.5K followersView on X
kokumօtօ@__kokumoto45d
Active Exploitation
米国サイバーセキュリティ・社会基盤安全保障庁(CISA)が既知の悪用された脆弱性カタログに4件の脆弱性を追加。 - CVE-2025-25249 (Fortinet複数製品) - CVE-2026-19490 (Citrix Netscaler) - CVE-2026-87491 (Chromium) - CVE-2026-20079 (Cisco FMC) https://www.cisa.gov/news-events/alerts/2026/09/09/cisa-adds-four-known-exploited-vulnerabilities-catalog
Post summary
CISA has added four CVEs—CVE-2025-25249, CVE-2026-19490, CVE-2026-87491, and CVE-2026-20079—to its catalog of known exploited vulnerabilities, confirming they are actively exploited in the wild.
1101441.3K
7.8K followersView on X
st3b1t@st3b1t44d
Patch
Vi consiglio di aggiorna subito Chrome alla v153 xke questa è molto grave: https://socprime.com/blog/cve-2026-87491-chrome-v8-zero-day-exploited/ #chrome #exploit
Post summary
The message urges users to patch Chrome to version 153 to fix a serious vulnerability; it does not provide PoC, exploit tools, or detailed technical data.
12060281
560 followersView on X
Cyllex@CyllexFramework37d
New writeup: Patch-Gap Zero-Days: BlueMoon. Five China-nexus clusters chained two V8 patch-gap bugs (CVE-2026-85046, CVE-2026-87491) to one Windows ALPC LPE zero-day (CVE-2026-85880) against Chrome on Windows. https://cyllex.io/blog/posts/bluemoon-chrome-patch-gap-cve-2026-85046.html
04031631
34 followersView on X
yousukezan@yousukezan45d
Active Exploitation
GoogleはChromeの脆弱性230件を修正し、このうちV8の境界外書き込み「CVE-2026-87491」が実際の攻撃で悪用されていると明らかにした。細工したHTMLページを通じて、Chromeのsandbox内で任意コード実行につながる。脆弱性はJavaScript／WebAssemblyエンジンV8にあり、out-of-bounds writeを引き起こす。修正版はChrome 153.0.8010.36以降で、WindowsとMacでは153.0.8010.36/.37、Linuxでは153.0.8010.36がStableとして提供される。 Googleは攻撃の技術詳細や攻撃者を公表していない。脆弱性はSeoul National UniversityのJihyeon Jeongが8月6日に報告し、2500ドルの報奨金が支払われた。 CVE-2026-87491は2026年に実悪用が確認されたChromeのゼロデイとして7件目。これまでにCSS、Skia、V8、Dawnなどの脆弱性が相次いで修正されている。 https://securityaffairs.com/198757/security/google-fixes-the-seventh-actively-exploited-chrome-zero-day-of-2026.html
Post summary
Google disclosed that CVE‑2026‑87491, an out‑of‑bounds write in V8, was actively exploited via crafted HTML pages, and they released a patch in Chrome 153.0.8010.36 and later versions.
010601.7K
16.5K followersView on X
CyberSignal | Cybersecurity & AI News@XQOPTRX31d
Active Exploitation
🚨 ATTACKERS CHAINED 3 ZERO-DAYS TO BREAK OUT OF CHROME AND COMPROMISE WINDOWS Volexity has uncovered a China-linked threat cluster tracked as UTA0565 exploiting the BlueMoon chain in targeted attacks. The chain combines: CVE-2026-85046 — Chrome ↓ CVE-2026-87491 — Chrome sandbox escape ↓ CVE-2026-85880 — Windows ALPC ↓ Arbitrary code execution ↓ CLEANGULP malware Researchers observed attacks on September 3–4 targeting Asian government entities through carefully crafted fake websites and phishing. The final malware supports: → Command execution → Process listing → File upload/download → BOF execution Attackers even spoofed recognizable media and NGO websites to make the operation more convincing. CyberSignal insight: One vulnerability may get patched. A complete exploit chain is what turns browser access into endpoint compromise. Sources: Volexity · The Hacker News #ThreatIntel #ZeroDay #CyberEspionage
Post summary
The text reports that a China-linked threat cluster actively exploited a three-zero-day chain to compromise Windows systems, with observed attacks in early September targeting government entities, and describes the resulting CLEANGULP malware's capabilities.
1102073
233 followersView on X
Anurag Verma@anurag_62944d
Active Exploitation
chrome just patched its seventh actively-exploited zero-day of the year. CVE-2026-87491 is an out-of-bounds write in v8 that let a crafted webpage execute code inside the sandbox. @googlechrome shipped the fix in 153.0.8010.36, two days after a Seoul National University researcher reported it, per Help Net Security: https://www.helpnetsecurity.com/2026/09/09/google-chrome-cve-2026-87491-zero-day-flaw/ update now. don't wait for auto-update to get to it.
Post summary
The post announces Chrome’s patch for CVE-2026-87491, noting it as the seventh actively exploited zero‑day of the year, and urges users to update to the fixed version.
00040165
324 followersView on X
Aviatrix Threat Research Center@aviatrixtrc45d
Active Exploitation
TRC analysis shows attackers exploiting CVE-2026-87491, a Chrome V8 zero-day, through crafted HTML pages to achieve remote code execution and escape browser sandboxes. This marks the seventh Chrome zero-day in 2026, with heap corruption enabling access to sensitive memory data. Runtime segmentation helps contain post-compromise lateral movement from compromised endpoints. #ZeroDay #CloudSecurity 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/google-chrome-zero-day-cve-2026-87491-v8-engine-2026
Post summary
The text reports that attackers have actively exploited CVE‑2026‑87491 via crafted HTML pages to achieve remote code execution and sandbox escape, providing detailed technical insights into the vulnerability’s heap‑corruption mechanism.
20020124
2.0K followersView on X
Davin Jackson@Djax_Alpha15d
How BlueMoon Exploits Chrome CVE-2026-85046 and CVE-2026-87491 https://cybersec.picussecurity.com/s/how-bluemoon-exploits-chrome-cve-2026-85046-and-cve-2026-87491-29943/1
00030173
9.1K followersView on X
Rudra Pratap@rudrapratap_20d
Active Exploitation
A Chrome zero-day with a public PoC is concerning. A Chrome zero-day with public PoCs, active exploitation, multiple threat actors, and targets across 6 countries and 9 sectors is a different problem. CVE-2026-87491 deserves a hunt, not just a patch. https://t.co/OBoakGqKFi
Post summary
The text explicitly reports active exploitation of CVE-2026-87491 (a Chrome zero-day) alongside public PoCs and global targets, with no named exploit tool, patch, or technical vulnerability details provided beyond the generic zero-day reference.
20010144
10 followersView on X
Anthony Bahn@HoustonIntrove133d
Active Exploitation
Managed Chrome still eats drive-bys. CVE-2026-85046 and CVE-2026-87491 escape V8, then chain Windows ALPC for browser-process code. Volexity today caught UTA0565 using fake media sites pre-patch. Force Chrome 153.0.8010.36+ and prove relaunch stuck. https://www.volexity.com/blog/2026/09/21/mind-the-patch-gap-part-2-fake-websites-used-to-deploy-chrome-windows-0-day-exploits/
Post summary
The text reports that threat actor UTA0565 is actively exploiting CVE-2026-85046 and CVE-2026-87491 via fake media sites, chaining V8 escapes with Windows ALPC, and advises forcing Chrome version 153.0.8010.36+ as a fix.
1002086
52 followersView on X
scorn// -::-@chaincod3r33d
Disclosure
chain: CVE-2026-85046: V8 type confusion in TurboFan JIT → arbitrary read/write in V8 heap CVE-2026-87491: V8 sandbox escape via WebAssembly metadata corruption → native code exec CVE-2026-85880: Windows kernel LPE via ALPC/WNF → system-level access one click. one chain.
Post summary
The post announces a three-stage vulnerability chain (V8 JIT confusion → sandbox escape → Windows kernel LPE) culminating in system-level access via 'one click,' with full technical detail but no mention of PoCs, exploit tools, patches, or active exploitation.
20010100
35 followersView on X
서버쟁이 놀이터@ueo0j38d
Active Exploitation
📊 9/17 통합 브리핑 연방 패치 기한이 줄줄이 도래·경과했다. 메일 게이트웨이·NAC·백업·RMM·가상화·방화벽 관리 — "보안을 위해 존재하는 장비"가 집중 표적이다. Cisco SEG는 오늘 마감, vCenter는 랜섬웨어 플래그까지 붙었다. —— 오늘 먼저 —— ① Cisco SEG CVE-2026-76461 — 연방 기한 오늘 메일 1통으로 미인증 root(SQL 인젝션). SEG·SEWM 가상·물리 모두, 설정 무관. Shadowserver 노출 400대+. 미패치는 침해 전제 + IOC 조사. ② VMware vCenter CVE-2026-59310 — 랜섬웨어·27일 경과 Syslog 디렉터리 트래버설→무인증 RCE. knownRansomwareCampaignUse: Known. 47개국 361+ IP 침해 흔적. 7월 패치 실적용 + 외부 노출 여부 확인. ③ ScreenConnect CVE-2026-84869 — 패치만으로 미완 26.6.5 업그레이드 + 호스트 클라이언트 재설치 + 액세스 에이전트 갱신. 8/20부터 웜형 전파. 기한 3일 경과 — IOC까지 한 묶음. —— AI —— ──────── ▣ Salesforce Koa·AIforce — 모델은 안으로, 인터페이스는 밖으로 핵심: Koa는 CRM 특화 추론 모델(NVIDIA Nemotron 3 Super 후속학습, 고객 데이터 미사용·합성 데이터만). AIforce는 앱을 열지 않고 데이터·권한·거버넌스에 접근(Claudeforce MCP 베타·Slackforce·Coworker). 미국 리전 정식은 2026 겨울. 왜 중요한가: 차별화 지점이 모델 성능이 아니라 데이터·권한·감사 계층. 사내 SaaS를 AI에 붙일 때 벤더 MCP의 권한·감사 범위를 먼저 확인. Koa "오류 3배"는 자체 벤치마크 — 독립 검증 없음. https://www.salesforce.com/news/press-releases/2026/09/15/koa-reasoning-model/ ──────── ▣ AI 감속 논쟁 — Dreamforce에서 젠슨 황과 공개 충돌 핵심: Amodei 감속 제안에 Altman·Musk 동조 → 9/14 반도체 지수 5.9%↓. Dreamforce에서 젠슨 황이 "AI 규제는 필요 없다, 안전은 우리에게" 발언. 보안주는 급등(SentinelOne ~16% 등). 왜 중요한가: 안전 담론이 가격에 직접 반영된 사례. 하루 등락을 추세로 읽으면 안 됨(유가·BofA 경고 겹침). 규제 대상 CEO 입장 표명이지 정책 변화가 아님. https://www.cnbc.com/2026/09/15/nvidia-and-anthropic-ceos-diverge-on-ai-safety-at-dreamforce.html ──────── ▣ Anthropic·OpenAI — 외부 안전 평가자 사내 상주 추진 핵심: 제3자 평가자를 프런티어 랩 내부에 두고 사고 보고·공개, 편집권은 기업이 갖지 않는 구조 제안. Meta·Google DeepMind·SpaceX AI는 미확약. METR·Apollo 등 논의 중. 왜 중요한가: CA SB 53·SB 813과 맞물린 자율 규제 단계. 체크포인트 접근·NDA로 "진짜 독립성" 논쟁 남음. 젠슨 황 발언과 정면 대비. https://techcrunch.com/2026/09/16/anthropic-and-openai-want-to-embed-safety-evaluators-will-they-really-be-independent/ ──────── ▣ 에이전트 권한 — Google Home 물리 제어·OpenAI 후원 에이전트 핵심: Google Home이 AI 에이전트의 스마트홈 직접 제어를 개방. OpenAI는 Sponsored Agents(라벨링된 후원 대화)와 Ads Manager 플러그인 테스트(HubSpot·Shopify). Anthropic은 챗·Cowork·Artifacts를 단일 창으로 통합. 왜 중요한가: 대화형 AI 수익이 배너에서 에이전트 대화 자체로 이동. 물리 기기·광고·어시스턴트 경계가 동시에 넓어짐 — 권한 위임·프롬프트 인젝션 피해 범위 확대. https://techcrunch.com/2026/09/16/your-ai-agents-can-now-control-your-google-home-devices/ —— 클라우드·데이터센터·인프라 —— ──────── ▣ 🔴 AWS 중동 리전 — 일부 자원 영구 복구 불가, 멀티 AZ 전제 붕괴 핵심: 바레인(me-south-1) 전체 접근·복구 불가. UAE(me-central-1) mec1-az2만 있던 데이터는 영구 접근 불가. 3~4월 물리적 시설 피해. AWS: "멀티AZ 설계 범위를 초과." 피해 DC 재개 없음. 왜 중요한가: 오늘 인프라 1순위. "멀티 AZ=안전" 가정의 실물 반례. 단일 리전 데이터 목록화·크로스리전 백업·주권 고정 워크로드 점검. 권고는 타 리전 마이그레이션. https://www.theregister.com/off-prem/2026/09/16/aws-says-wartime-damage-means-some-middle-east-cloud-resources-are-gone-for-good/5296830 ──────── ▣ Salesforce 글로벌 장애 — Dreamforce 중, "복구 완료"는 과함 핵심: 내부 로그인 서비스 응답 대기로 자원 고갈. 미·일·인도·영·프·독 등 수백 인스턴스, Hyperforce 특히 타격. 시작 약 07:50 UTC. 재검증 시점엔 완전 해소로 표시되지 않음(잔여를 Hyperforce 일부로 축소). 왜 중요한가: 인증 서비스 하나가 SaaS 전체 단일 실패 지점. 임계 경로면 10시간 대체 절차·Hyperforce 여부·상태 페이지를 직접 확인. 원본 "복구 완료"로 종결 금지. https://www.theregister.com/saas/2026/09/16/salesforce-staggers-back-to-feet-after-global-outage/5296800 ──────── ▣ AI 인프라 병목 — 칩→전기: AEMA 출범·Google 핀란드 원전 PPA 핵심: Emerald AI·Google·NVIDIA가 AEMA(AI Energy Management Alliance) 창립 — DC 전력 동적 조절·계통 접속 가속 목표. Google은 핀란드에 최소 €130억(Hamina 확장+신규 DC), Fortum Loviisa 원전 출력 최대 50%를 22년 구매. 왜 중요한가: 병목이 GPU에서 계통 접속으로 이동했음을 업계가 공식 인정. 원전 PPA가 하이퍼스케일 입지 요건. AEMA는 연합 결성이지 접속 성과는 아님. https://blogs.nvidia.com/blog/ai-energy-management-alliance/ —— 보안·규제 —— ──────── ▣ NIST·CISA — 토큰·어서션 위조·탈취 방어 권고 핵심: 하이브리드/멀티클라우드 SSO·페더레이션·API의 신원 어서션·액세스 토큰·암호 메커니즘 보호 구현 지침. Secure by Design, 연방·CSP 주 대상. 왜 중요한가: 최근 클라우드 침해의 상당수가 취약점보다 토큰 탈취·위조. 화제성은 낮지만 실제 침해 경로의 중심. SSO 조직은 설계 점검 기준으로 즉시 사용 가능. https://www.cisa.gov/resources-tools/resources/protecting-tokens-and-assertions-forgery-theft-and-misuse-implementation-recommendations-agencies ──────── ▣ CISA 사이버 디코이 가이드 — 침해 전제 탐지 핵심: 트립와이어·브레드크럼·허니토큰 등 기만 기술로 침해 후 활동 탐지. MITRE Engage·ATT&CK 매핑. LOTL·합법 자격증명 공격자 겨냥, 고신뢰 경보 수단으로 위치. 왜 중요한가: 경계 방어→침해 전제 내부 탐지를 규제기관이 문서로 지지. 관리 plane이 뚫리는 오늘 패턴과 같은 방향. 소규모 팀도 단계 도입 가능. https://www.cisa.gov/resources-tools/resources/using-cyber-decoys-strengthen-detection-and-response ──────── ▣ 스페인 데이터보호청 — 첫 "AI 기반 침해" 신고 접수 핵심: LLM 기반 AI 에이전트를 사용한 공격이 스페인 당국에 정식 신고. 규제기관 접수 첫 사례. 왜 중요한가: GDPR 침해 신고에 "AI 에이전트 사용"이 실제로 기록되기 시작. EU 대상 서비스는 침해 대응 문서·보고 양식 선점검. https://www.bleepingcomputer.com/news/security/spains-data-agency-gets-first-report-of-ai-powered-data-breach/ ──────── ▣ CISA BOD 26-04 — "모든 CVE 균등 패치"의 종료 핵심: KEV 추가 알림에서 BOD 26-04(위험 기반 보안 업데이트 우선순위) 재인용. 공개 노출 자산의 KEV 고위험 신속 조치·패치 전 침해 점검이 기대치. 민간에도 동일 우선순위 권고. 왜 중요한가: KEV·실악용 중심 운영이 연방 표준으로 고착. 상단 기한 대조표가 그 운영 모델의 실제 적용 형태. https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-one-known-exploited-vulnerability-catalog —— 취약점·해킹 —— ──────── ▣ 🔴 Cisco Secure Email Gateway CVE-2026-76461 — 오늘 마감 핵심: AsyncOS 메일 파싱 SQL 인젝션→하부 OS root 명령. 미인증·무상호작용. SEG·SEWM 설정 무관 취약. Cisco PSIRT가 9월 실악용 확인. KEV 기한 2026-09-17=오늘. 노출 400대+. 왜 중요한가: CVSS급 최상위·메일 1통·우회 없음·실악용·기한 오늘이 동시. 보유 여부→패치→미패치는 IOC까지. AsyncOS 최근 두 번째 제로데이. https://www.bleepingcomputer.com/news/security/new-cisco-secure-email-zero-day-exploited-to-execute-commands-as-root/ ──────── ▣ 🔴 VMware vCenter CVE-2026-59310 — 랜섬웨어 전환 확인 핵심: Syslog 디렉터리 트래버설→무인증 RCE. Broadcom 7/29 패치→KEV 8/18→기한 8/21(27일 경과). 카탈로그 knownRansomwareCampaignUse: Known. 47개국 361+ IP, 노출 vCenter 450대+. 왜 중요한가: "7월에 패치했다" 착각 조직이 오늘의 리스크. vCenter 장악=가상화 계층 일괄 암호화. 빌드 번호로 실적용+외부 노출 차단. https://www.bleepingcomputer.com/news/security/cisa-critical-vmware-vcenter-rce-flaw-now-exploited-by-ransomware-gangs/ ──────── ▣ 🔴 ScreenConnect CVE-2026-84869 — 웜형, 8/20부터 악용 핵심: 권한 검증 누락→활성 세션에서 Host 확인 없이 파일 전송·실행(CVSS 9.9). 수정 26.6.5 + 호스트 클라이언트 재설치 + 액세스 에이전트 갱신. 서버 자체는 비대상. 임시 완화: TransferFiles 비활성. KEV 기한 9/14 경과. 왜 중요한가: RMM 침해=관리 엔드포인트 즉시 확산. VBScript 4개로 지속성·웜 전파. 패치 여부와 무관하게 IOC 조사. https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin ──────── ▣ 🟠 Google Pixel 모뎀 CVE-2026-58704 — KEV 기한 9/19 핵심: 셀룰러 모뎀 권한 우회/상승(CVSS ~8.0). 사용자 상호작용 불필요, 인접 네트워크+기본 권한. Google "제한적·표적 악용 가능성." 패치 레벨 2026-09-05 이상. 9월 Pixel 불레틴 110건. 왜 중요한가: 5개 원본이 모두 보고한 유일한 항목. 물리적 근접만으로 무선 공격 — 임원·고위험군 단말 우선. MDM/BYOD Pixel 패치 강제. https://www.bleepingcomputer.com/news/security/google-fixes-actively-exploited-android-zero-day-on-pixel-devices/ ──────── ▣ 🟠 Cisco ISE·Acronis Backup — KEV 기한 9/19 핵심: CVE-2026-76460(ISE 권한 API 오사용), CVE-2026-87886(Acronis 부적절한 기본 권한). 둘 다 실악용·KEV 등재 9/16. Acronis cPanel 플러그인 권한 상승도 실악용 정황. 왜 중요한가: NAC·백업이 동시에 표적. ISE 장악=횡적 이동, 백업은 랜섬 1순위. vCenter와 묶어 관리 plane 일괄 점검. https://www.cisa.gov/news-events/alerts/2026/09/16/cisa-adds-two-known-exploited-vulnerabilities-catalog ──────── ▣ 🟠 Check Point VPN CVE-2026-85102/85103 — "임박", KEV 미등재 핵심: 둘 다 CVSS 9.8. 인증서 신뢰 검증 미비·ASN.1 힙 오버플로→RCE. Gateway+Management Server 영향. 공개 PoC·확인된 실악용 없음·KEV 없음. 네덜란드 NCSC "곧 시도 예상." LivePatch Take 24 등. 왜 중요한가: 인터넷 노출 VPN은 초기 침투 1순위 — 패치 창이 짧음. 단 "악용 중"으로 보고하면 과장. LivePatch 활성화 여부를 직접 확인. https://support.checkpoint.com/results/sk/sk1000117 ──────── ▣ Microsoft 9월 패치 — 기준값 974건, 0-day 2건·KB5124008 회귀 핵심: 집계 기준 차이로 966~997(기준값 974, Tenable 964는 MS 자체 CVE만). 실악용 0-day CVE-2026-85880(ALPC)·CVE-2026-81963(Update Stack), KEV 기한 9/22. KB5124008 적용 후 일부 도메인 trust/secure channel 장애 보고. 왜 중요한가: 역사상 최대 규모. 패치와 회귀를 같이 봐야 함. Critical·외부노출(DNS·Kerberos 등) 우선. 건수 단정 인용 금지. https://www.securityweek.com/microsoft-patches-record-974-vulnerabilities-including-two-exploited-zero-days/ ──────── ▣ 🔴 브라우저 확장 하나로 AI 어시스턴트 장악 핵심: webpage modification+declarativeNetRequest 권한만으로 신뢰된 AI 페이지에 코드 주입(Chrome Gemini Live·Perplexity Comet·Edge·Opera Neon·Claude in Chrome). Chrome 143.0.7499.192·Edge 150.0.4078.48 패치. Comet·Neon·Claude 확장은 패치 시점 비공개. 실악용 보고 없음(연구 단계). 왜 중요한가: 확장 설치 정책=AI 에이전트 보안 경계. 허용목록 운영. Chrome을 올릴 때 V8 KEV(CVE-2026-85046 내일 마감·CVE-2026-87491)도 함께. https://thehackernews.com/2026/09/one-extension-could-hijack-ai.html ──────── ▣ 🟠 Shai-Hulud — AI 코딩 세션이 공급망 침투 경로로 실증 핵심: AI 코딩 어시스턴트 세션 탈취→오염 PyPI→GitHub OAuth→내부 레포 ~100개에 웜 배포→사내 네임스페이스 신뢰로 2차 감염(Mandiant). Artifactory CVE-2026-42016/42018(기한 9/25)과 겹치면 빌드 산출물 오염 경로가 양쪽에서 열림. 왜 중요한가: 신규 위협 카테고리. AI 추천 의존성 체크섬·허용목록, OAuth 격리, 내부 프록시 경유, 사내 네임스페이스도 신뢰 경계로 취급. https://thehackernews.com/2026/09/attacker-hijacks-ai-coding-assistant.html ──────── ▣ 🔴 기한 경과 KEV — MikroTik·GitLab·Cisco FMC 핵심: RouterOS CVE-2026-86060/67277(기한 9/13, MikroTrick 무인증 장악). GitLab CVE-2026-85706(기한 9/14). Cisco Secure FMC CVE-2026-20079(기한 9/12). 뒤 2건은 모델 원본 5건 모두 누락 — KEV 카탈로그 대조에서만 발견. 왜 중요한가: 소스·CI 자격증명(GitLab)·방화벽 관리 plane(FMC)·경계 라우터. 기한 경과=침해 전제 조회. 다중 모델 취합이 1차 카탈로그를 대체하지 못함. https://www.cisa.gov/known-exploited-vulnerabilities-catalog —— 개발자·엔터프라이즈 —— ──────── ▣ Java 27 — Compact Object Headers 기본 ON (non-LTS) 핵심: 객체 헤더 96→64비트, SPECjbb2015 기준 힙 22%·CPU 8% 절감. GC 기본 G1(작은 컨테이너도 Serial→G1). TLS 1.3에 ML-KEM 하이브리드(JEP 527). 출시 2026-09-15. 왜 중요한가: 튜닝 없이 메모리 절감. non-LTS라 검증용. 메모리 빡빡한 워크로드는 G1 전환 벤치 필수. https://openjdk.org/jeps/534 ──────── ▣ Homebrew 7.0.0 — brew vulns·샌드박스 강화 핵심: brew vulns+OSV 연동 advisory DB. 홈 디렉터리 기본 차단, 네트워크 다운로드·오프라인 설치 분리. Intel Mac은 Tier 3 강등, macOS 10.15 지원 종료. 왜 중요한가: 패키지 매니저가 SBOM/취약점 가시성 내재화 — Shai-Hulud류 공급망 대응 실무 도구. CI에서 샌드박스·Intel 러너 영향 먼저 검증. https://brew.sh/2026/09/13/homebrew-7.0.0/ ──────── ▣ Kubernetes v1.37 — Memory QoS·Pod Resource Managers 기본 ON 핵심: Pod-Level Resource Managers·Memory QoS가 Beta로 기본 활성화. CSI Changed Block Tracking API Beta. Bind Mount/EmptyDir 권한으로 컨테이너 저장소 하드닝. 왜 중요한가: 옵트인이 아니라 기본값 변경. 업그레이드 순간 메모리 회수 동작이 바뀔 수 있음. Acronis KEV와 묶어 백업 스택 점검. https://kubernetes.io/blog/2026/09/14/kubernetes-v1-37-memory-qos-graduates-to-beta/ ──────── ▣ GitHub — Copilot 예산을 FinOps·IAM 문제로 재정의 핵심: Copilot 예산 증액 요청 GA(관리자 승인·조정). Code Scanning AI Scan이 CodeQL default setup 없이도 PR에서 사용 가능. classic PAT/SSH의 조직별 SSO authorization 자동화. 왜 중요한가: AI 개발도구가 "허용 여부"에서 사용자별 예산 정책으로 이동. AI Scan은 CodeQL 미도입 레포에 즉시 적용. 토큰 보호 권고와 같은 축. https://github.blog/changelog/2026-09-16-copilot-budget-increase-requests-are-generally-available/ 기한이 산 것은 Chrome V8(내일)·Pixel·ISE·Acronis(9/19)·Windows 0-day(9/22)·Artifactory(9/25)뿐이고, SEG는 오늘·ScreenConnect·MikroTik·GitLab·FMC·vCenter는 이미 지났다. 관리 plane부터 열어라. #IT브리핑 #Cisco #CISA #KEV #VMware #ScreenConnect #AWS #Salesforce #CheckPoint #Microsoft #Pixel #Artifactory #Homebrew #Kubernetes #AI에이전트
Post summary
The briefing highlights multiple actively exploited vulnerabilities across various vendors, including Cisco, VMware, and ScreenConnect, with confirmed in-the-wild exploitation, ransomware campaigns, and urgent patch deadlines.
000302.0K
79 followersView on X
DFIR Radar@DFIR_Radar39d
Active Exploitation
Two Chinese 🇨🇳 espionage groups ran the same three-CVE Chrome/Windows zero-day chain against NGOs before Google shipped a patch, deploying different backdoors from what Volexity assesses was a shared exploit kit. - CVE-2026-85046 (V8 type confusion) chains with CVE-2026-87491 (WebAssembly sandbox escape) and CVE-2026-85880 (Windows kernel privilege escalation) to fully escape Chrome's renderer and inject into the browser process. The core flaw was patched in Chromium source on August 4 but not in Chrome stable until September 3 (version 152.0.7977.82/.83). CISA added it to KEV with a September 18 federal remediation deadline. - UTA0560 delivered GRIMWEDGE, a sub-250-line JScript backdoor running in-memory inside msiexec.exe covering recon, file ops, and command execution. JungleBamboo (APT31/Violet Typhoon) deployed SUPERSTOMP, a loader that installs LONGTALE, a malicious Chrome extension masquerading as Google Gemini to keylog, steal cookies, session tokens, and take screenshots. - SUPERSTOMP bypasses Chrome's 2025-2026 profile integrity hardening by stripping encrypted preference hashes and forging legacy HMAC values Chrome still accepts as fallback. That fallback remains enabled by default as of September 8, 2026. - Byte-for-byte identical shellcode across both campaigns plus Proofpoint identifying four groups using the same kit (tracked as BlueMoon) within two weeks points to a sold or shared exploit, not parallel development. #DFIR_Radar
Post summary
Chinese espionage groups actively exploited a three-CVE Chrome/Windows zero-day chain against NGOs using the BlueMoon exploit kit; CISA KEV listing and specific Chrome patch version 152.0.7977.82/.83 are provided.
10011223
1.9K followersView on X
CyberSignal | Cybersecurity & AI News@XQOPTRX39d
Active Exploitation
🚨 CHINA-LINKED HACKERS CHAINED THREE CHROME + WINDOWS ZERO-DAYS TO COMPROMISE NGOs Then another Chinese espionage group used the SAME exploit chain. CyberSignal Priority: 🔴 VERY HIGH The chain: CVE-2026-85046 + CVE-2026-87491 + CVE-2026-85880. Volexity says a China-linked cluster tracked as: UTA0560 targeted multiple NGOs using a sophisticated spear-phishing campaign. The attack starts innocently: PHISHING EMAIL ↓ link to legitimate U.S. university website ↓ reflected XSS vulnerability abused ↓ victim redirected to attacker infrastructure. Then: CVE-2026-85046 ↓ arbitrary read/write inside Chrome V8 sandbox CVE-2026-87491 ↓ CHROME SANDBOX ESCAPE CVE-2026-85880 ↓ Windows ALPC exploitation ↓ browser-process injection ↓ ARBITRARY CODE EXECUTION. Final payload: GRIMWEDGE. The JavaScript backdoor can: → enumerate files → enumerate processes → kill processes → read files → execute commands → download additional payloads. But there's another major development. Volexity observed a SECOND China-nexus actor: JUNGLEBAMBOO / APT31 using the same exploit chain around the same time. Its payload included: LONGTALE a credential-stealing Chrome extension masquerading as: GOOGLE GEMINI. Capabilities included: → keylogging → form capture → cookie theft → session theft → screenshots → browser-storage theft → browsing-history collection → remote C2. Researchers say the near-simultaneous use by multiple Chinese actors raises the possibility that the exploit chain was distributed or sold by a common exploit developer. ⚠️ One especially important detail Some vulnerabilities had already been fixed upstream in Chromium... but had NOT yet reached stable Google Chrome. That patch gap created a temporary: N-DAY IN CHROMIUM + ZERO-DAY IN CHROME situation. 🧠 CyberSignal insight Publishing a patch can sometimes begin a race. DEFENDERS must distribute it. ATTACKERS only need to reverse-engineer it. AI-assisted vulnerability research could make that patch gap increasingly dangerous. Sources: Volexity · Proofpoint · The Hacker News Published September 15, 2026
Post summary
Chinese threat actors actively exploited three zero‑day CVEs against NGOs, delivering GRIMWEDGE and LONGTALE payloads, while upstream Chromium patches had not yet been released to stable Chrome, creating a temporary n‑day window.
02010188
233 followersView on X
Vikram Dias@BigVikDada45d
Active Exploitation
Microsoft shipped a record September Patch Tuesday. 974 CVEs in the full release. About 964 of those are on the customer. Two of them were already being exploited: CVE-2026-81963 in the Windows Update Stack and CVE-2026-85880 in ALPC. Both CVSS 7.8. Both local elevation to SYSTEM. CISA put both on KEV. Federal due date is 22 September 2026. CVE-2026-85880 is a heap overflow in Advanced Local Procedure Call. Microsoft says an attacker who can run code in a low-privilege AppContainer can escape the sandbox and land SYSTEM with no extra click. Proofpoint reported it. CISA did not name the campaign. CVE-2026-81963 is link-following in the Update Stack, the machinery that installs the patches. First Update Stack zero-day in five years of tracking that component. Same outcome: low-priv to SYSTEM. Neither is a remote foothold by itself. That is the operational lesson, not the headline. These are stage-two bugs. Phish, stolen token, or a browser chain first. Then SYSTEM. SecurityWeek also flagged about 20 potentially wormable issues in the same drop. Do not let the 974 number become the queue. Same window: Chrome 153. CVE-2026-87491, out-of-bounds write in V8. Google: exploit exists in the wild. Seventh Chrome zero-day patched in 2026, second in under five days after CVE-2026-85046. Fixed in 153.0.8010.36/.37. Rollout is gradual. Version on the endpoint is the control, not the blog post. Adobe Commerce / Magento CVE-2026-75650 (CVSS 10, exploited, KEV, federal due 11 September) sits next to this if you run storefronts. N-able N-central CVE-2026-86218 is already on KEV with an 11 September due date. That one is a different ticket. What I would take into the room: 1. Prioritize CVE-2026-81963 and CVE-2026-85880 on every Windows 10/11 and Server build. Confirm KB, not “Patch Tuesday ran.” 2. Force Chrome / Edge Chromium to 153.0.8010.36 or later. Screenshot version before and after. Edge rides V8 too. 3. Hunt from 1 August 2026 for unusual SYSTEM processes spawned from AppContainer or wuauclt / Update Stack paths. Do not wait for a named malware family. 4. If you have on-prem N-central, 2026.3 HF4 (2026.3.1.14) is the floor. Hosted was patched server-side. Hunt new local accounts. 5. Adobe Commerce operators: treat 11 September as a hard date, not a suggestion. What it is not: proof that AI-found bugs equal mass remote worms this month. Trend Micro ZDI noted the disclosure volume is up and the active-exploit spike is not matching it yet. The two KEVs still get patched first. Source: Microsoft September 2026 security updates; CISA KEV additions 8 Sep 2026; Google Chrome 153 stable notes for CVE-2026-87491. #patchtuesday #KEV #Chrome #Windows
Post summary
The post highlights CVE‑2026‑81963 and CVE‑2026‑85880 as actively exploited in the wild, urging immediate patching and monitoring, while also noting other vulnerable Chrome and Adobe bugs.
10011276
159 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	google	chrome	-	-	-

Explore more

Back to dashboard google CVEs chrome vulnerabilities

What researchers are saying

CVE-2026-87491

Volexity[verified]@VolexityActive Exploitation

Volexity reports ongoing attacks by Chinese threat actors using a chain of new 0‑day exploits in Chrome and Windows, indicating that CVE‑2026‑85046, CVE‑2026‑87491 and CVE‑2026‑85880 are being actively abused.

Volexity[verified]@VolexityActive Exploitation

The text reports active, in-the-wild exploitation of three zero-day vulnerabilities (two Chrome, one Windows) by threat actor UTA0565 in early September 2026, detailing the use of fake websites, a customized exploit framework, and a novel malware family (CLEANGULP).

kokumօtօ[verified]@__kokumotoActive Exploitation

CISA has added four CVEs—CVE-2025-25249, CVE-2026-19490, CVE-2026-87491, and CVE-2026-20079—to its catalog of known exploited vulnerabilities, confirming they are actively exploited in the wild.

yousukezan[verified]@yousukezanActive Exploitation

Google disclosed that CVE‑2026‑87491, an out‑of‑bounds write in V8, was actively exploited via crafted HTML pages, and they released a patch in Chrome 153.0.8010.36 and later versions.

Anurag Verma[verified]@anurag_629Active Exploitation

The post announces Chrome’s patch for CVE-2026-87491, noting it as the seventh actively exploited zero‑day of the year, and urges users to update to the fixed version.

Aviatrix Threat Research Center[verified]@aviatrixtrcActive Exploitation

The text reports that attackers have actively exploited CVE‑2026‑87491 via crafted HTML pages to achieve remote code execution and sandbox escape, providing detailed technical insights into the vulnerability’s heap‑corruption mechanism.

Anthony Bahn[verified]@HoustonIntrove1Active Exploitation

The text reports that threat actor UTA0565 is actively exploiting CVE-2026-85046 and CVE-2026-87491 via fake media sites, chaining V8 escapes with Windows ALPC, and advises forcing Chrome version 153.0.8010.36+ as a fix.

서버쟁이 놀이터[verified]@ueo0jActive Exploitation

The briefing highlights multiple actively exploited vulnerabilities across various vendors, including Cisco, VMware, and ScreenConnect, with confirmed in-the-wild exploitation, ransomware campaigns, and urgent patch deadlines.