hacker-news · Crawled Sep 9, 2026
Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox
4 CVEs
Read original article ↗
AI Summary
A zero-day vulnerability in Chrome's V8 JavaScript and WebAssembly engine, tracked as CVE-2026-87491, is being actively exploited in the wild. The flaw is an out-of-bounds write that allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. Google has patched the vulnerability in Chrome versions 153.0.8010.36 and later, but has not disclosed specific details about the exploitation or the threat actor involved, likely to prevent further abuse before widespread patching.
AI-extracted · verify before operational use
Extracted Entities 4 found
MITRE ATT&CK TTPs 21 techniques
T1055 Process Injection · Defense Evasion T1189 Drive-by Compromise · Initial Access T1203 Exploitation for Client Execution · Execution T1005 Data from Local System · Collection T1021 Remote Services · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1048 Exfiltration Over Alternative Protocol · Exfiltration T1053.005 Scheduled Task · Execution T1055.012 Process Hollowing · Defense Evasion T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1071 Application Layer Protocol · Command And Control T1071.001 Web Protocols · Command And Control T1082 System Information Discovery · Discovery T1085 T1085 T1090 Proxy · Command And Control T1105 Ingress Tool Transfer · Command And Control T1190 Exploit Public-Facing Application · Initial Access T1204.002 Malicious File · Execution T1566 Phishing · Initial Access