VulnSocial
← Back to blog

CVE-2026-11645 – High‑Severity Chrome V8 Zero‑Day Actively Exploited

Key takeaways

  • Severity: High (CVSS 8.8)
  • Impact: Remote code execution via out‑of‑bounds read/write in V8 (JavaScript/WebAssembly)
  • Scope: Affects Google Chrome (all platforms) and Chromium‑based browsers
  • Status: Actively exploited in the wild; added to CISA KEV
  • Action: Deploy the patch (Chrome 149.0.7827.102/103) immediately

Overview

Google released an emergency update that fixes 74 vulnerabilities in Chrome, including CVE-2026-11645, a high‑severity zero‑day in the V8 JavaScript engine. The flaw allows out‑of‑bounds memory access that can be chained to arbitrary code execution inside the browser sandbox. Threat intel confirms that the vulnerability is being weaponized in the wild, prompting its inclusion in the U.S. CISA Known Exploited Vulnerabilities (KEV) catalog.

Technical Details

  • Vulnerability type: Out‑of‑bounds read (CWE‑125) and write (CWE‑787) in V8.
  • Attack vector: Network‑reachable, low‑complexity, requires user interaction (opening a malicious HTML page). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
  • Impact: Full compromise of the user’s session; the attacker can execute native code, bypass same‑origin policy, and potentially escape the sandbox.
  • Exploitation evidence: Multiple security feeds reported active exploitation from the day of disclosure (June 9 2026) with daily mention spikes and confirmed exploit attempts.

Severity & Impact

The CVSS base score of 8.8 classifies the vulnerability as High. The combination of a network‑accessible vector, no privileges required, and complete compromise (confidentiality, integrity, availability) makes it a critical risk for any organization that permits web browsing on unmanaged devices.

CVE IDCVSSSeverityAffected Product
CVE-2026-116458.8 (3.1)HighGoogle Chrome (pre‑149.0.7827.102)

Affected Products

The vulnerability impacts Google Chrome on Windows, macOS, and Linux prior to version 149.0.7827.102 (or 149.0.7827.103 for macOS). Because V8 is shared across Chromium‑based browsers, the issue also affects Microsoft Edge, Brave, Opera, and Vivaldi when they run vulnerable engine versions. For a complete list of affected CPE entries and version ranges, see the detailed CVE page: https://vulnsocial.com/cve/CVE-2026-11645.

What to Do Now

  • Deploy the patch – update Chrome to 149.0.7827.102 (Windows/macOS/Linux) or 149.0.7827.103 (macOS) via the stable channel.
  • Enforce auto‑update policies across all endpoints using enterprise management tools (e.g., Google Admin console, SCCM, Intune).
  • Verify versions post‑deployment (chrome://version or inventory tools) to confirm the patch is applied.
  • Mitigate legacy browsers – if immediate patching is not possible, block or sandbox browsers older than the fixed version, and consider disabling JavaScript or WebAssembly on high‑risk sites.
  • Monitor for exploitation – look for anomalous network traffic to known malicious domains, unexpected child processes, or V8‑related crash dumps. Enable EDR alerts for the CVE identifier.
  • Apply CISA KEV guidance – follow the recommended mitigations, including the BOD 22‑01 guidance for cloud services that rely on Chrome for authentication flows.

Remediation & Mitigation

  1. Patch all Chrome installations to version 149.0.7827.102/103.
  2. Verify the patch via chrome://version or your asset inventory.
  3. For unpatched systems, enable site isolation and disable WebAssembly where feasible.
  4. Deploy web‑filtering rules to block known malicious URLs delivering the exploit.
  5. Integrate CVE alerts into SIEM/EDR platforms and correlate with CISA KEV advisories.

Bottom Line

CVE-2026-11645 is a High‑severity V8 out‑of‑bounds vulnerability actively exploited in the wild. Immediate deployment of the Chrome 149.0.7827.102/103 patch and enforcement of strict update policies are essential to prevent remote code execution and potential system compromise.

References

#CVE202611645 #CVE #High #Chrome #V8 #CISAKEV #ZeroDay