CVE-2026-11645Active Exploitation(apple / chrome)

CRITICALCVSS 8.8 · HIGHCISA KEV

Exploitation observed; activity peaked at 60 mentions and remains active

Immediate actions

Patch apple chrome systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

apple CVEs Back to dashboard

9.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-06-23. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vendor / third-party advisories

https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html

Other references

Weakness type (CWE)

CWE-125CWE-787

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

chrome
linux_kernel
macos
windows

Threat summary

Active exploitation appears in 127 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
153 mentions across 33 observed days

What's happening

Active exploitation reported across 127 signals
Exploit tool or code specified in 3 signals
PoC mentioned or linked in 10 signals
Patch or workaround mentioned in 117 signals
Technical details provided in 81 signals
General: 10 classified signals
Peaked 32d ago at 60 mentions (2026-06-09); latest day: 1
153 total mentions across 33 days

Affected systems

Vendors

apple google linux microsoft

Products

chromelinux_kernelmacoswindows

1 version affected across 4 products

Deep dive

Activity timeline153 mentions / 33d

Signal classification6 categories

Active Exploitation

9260.1%

Patch

4529.4%

General

106.5%

Disclosure

32.0%

Exploit

21.3%

PoC

10.7%

Referenced assets94 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-09	60	Active Exploitation37General1Patch21PoC1
2026-06-10	28	Active Exploitation19Exploit1Patch8
2026-06-11	5	Active Exploitation3General1Patch1
2026-06-12	4	Active Exploitation3Patch1
2026-06-13	3	Active Exploitation2Patch1
2026-06-14	3	Active Exploitation2Patch1
2026-06-15	5	Active Exploitation3Disclosure1General1
2026-06-16	2	Active Exploitation1Patch1
2026-06-17	4	Active Exploitation1Patch3
2026-06-18	4	Active Exploitation4
2026-06-20	2	Disclosure1Patch1
2026-06-21	2	Active Exploitation2
2026-06-22	2	Active Exploitation1General1
2026-06-23	1	Active Exploitation1
2026-06-24	1	Active Exploitation1
2026-06-29	1	Active Exploitation1
2026-06-30	2	Active Exploitation1General1
2026-07-03	1	Patch1
2026-07-05	2	General1Patch1
2026-07-06	4	Active Exploitation3Patch1
2026-07-08	1	General1
2026-07-10	1	General1
2026-07-11	1	General1
2026-08-16	1	Patch1
2026-08-21	1	Exploit1
2026-08-24	2	Active Exploitation1General1
2026-09-01	3	Active Exploitation1Patch2
2026-09-02	1	Active Exploitation1
2026-09-04	1	Patch1
2026-09-06	1	Active Exploitation1
2026-09-09	2	Active Exploitation2
2026-09-16	1	Active Exploitation1
2026-09-30	1	Disclosure1

Full discourse20 posts

The Hacker News@TheHackersNews136d
Patch
🚨 WARNING: Google just fixed a Chrome zero-day already used in real attacks. The bug (CVE-2026-11645) hits V8, Chrome’s JavaScript engine, and can let attackers run code through a crafted HTML page. Update your browser now. Read the full story: https://thehackernews.com/2026/06/chrome-v8-zero-day-cve-2026-11645.html
Post summary
Google has released a patch for Chrome zero‑day CVE‑2026‑11645, which lets attackers execute code through crafted HTML and has already been exploited in the wild. Users are urged to update their browsers immediately.
27951924033.8K
2.0M followersView on X
Hossein Lotfi@hosselot112d
Patch
Root cause of Google Chrome V8 ITW (CVE-2026-11645)[506689381]: TryFastAddDataProperty[1] needs a fast MAP[5]. But "after" checking[2], Map::PrepareForDataProperty[3] manages to normalize the map. The patch[4] rechecks for slow dictionary MAP afterwards. https://chromium-review.googlesource.com/c/v8/v8/+/7807043 https://t.co/pQUvO8Xbc0
Post summary
The post explains the root cause of CVE‑2026‑11645 in Chrome’s V8 engine and references the patch that fixes the issue.
11421105221.5K
6.6K followersView on X
xvonfers@xvonfers136d
PoC
(CVE-2026-11645)[$55000][506689381][objects] PoC: ``` let key = 'AA'; let value = 2; class C extends Function { [key] = value; } let o1 = new C('\'use strict\''); value = 1.1; let o2 = new C('\'use strict\''); ```
Post summary
The post offers a JavaScript PoC snippet for CVE‑2026‑11645 but lacks any evidence of active exploitation, patch information, or detailed vulnerability specifics.
1110935912.9K
5.0K followersView on X
Hossein Lotfi@hosselot63d
Exploit
Exploitation steps and a reliable exploit for Google Chrome ITW V8 TryFastAddDataProperty vulnerability (CVE-2026-11645 [506689381]): https://issues.chromium.org/issues/506689381#comment12
Post summary
The post announces reliable exploitation steps and code for CVE‑2026‑11645, focusing on an active exploit rather than a patch or false‑positive.
115167467.1K
6.6K followersView on X
Tashita Software Security@TashitaSoftSec60d
Active Exploitation
CVE-2026-11645 is a V8 vulnerability that Google confirmed had been actively exploited. Based on the analysis of the PoC structures, the patch, and the internal functions, we show how to use SeekZero’s Mutation Plan to direct mutations toward the V8 code we want to explore. The post includes a full video of the process, from the original PoC to the final Mutation Plan configuration. Check it out: https://tashita.net/cve-2026-11645-v8-vulnerability-seekzero-mutation-plan/
Post summary
Google confirmed that CVE-2026-11645 is actively exploited, and the post shares a PoC video using a Mutation Plan, though no concrete exploit code is disclosed.
014041313.5K
126 followersView on X
CISA Cyber@CISACyber136d
General
🛡️ We added Arista EOS vulnerability CVE-2026-7473, Google Chromium V8 vulnerability CVE-2026-11645, & Cisco Catalyst vulnerability CVE-2026-20245 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/wE7nxnz7xf
Post summary
The tweet announces that three new CVEs have been added to the DHS KEV catalog and directs readers to a link for mitigations, but it offers no technical details, PoC, or evidence of active exploitation.
41633525.2K
300.6K followersView on X
xvonfers@xvonfers136d
Active Exploitation
👀 (CVE-2026-11645)[$55000][506689381][objects]OOB access https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html https://chromium-review.googlesource.com/c/v8/v8/+/7807043 Reported by 303f06e3, exploited ITW
Post summary
CVE-2026-11645 was discovered and is currently being exploited in the wild; a patch has been released as part of the stable‑channel update.
041341515.3K
5.0K followersView on X
GovCERT.CZ@GOVCERT_CZ136d
Active Exploitation
🚨 Upozorňujeme na aktivně zneužívanou Zero-day zranitelnost v Google Chrome, CVE-2026-11645. Jedná se o vysoce závažnou chybu typu out-of-bounds read/write v enginu V8 (JavaScript a WebAssembly), která umožňuje vzdálenému útočníkovi spustit libovolný kód v sandboxu prostřednictvím speciálně vytvořené HTML stránky. Zranitelnost se týká verzí Google Chrome starších než 149.0.7827.103 a byla aktivně zneužívána v reálných útocích. Úspěšné zneužití může vést ke kompromitaci systému uživatele při pouhém otevření škodlivé webové stránky. Uživatelé dalších prohlížečů založených na Chromiu (Microsoft Edge, Brave, Opera, Vivaldi) by měli rovněž aplikovat dostupné aktualizace. 📌Doporučujeme aktualizovat na verze 149.0.7827.102/.103 pro Windows a macOS a 149.0.7827.102 pro Linux.
Post summary
Chrome CVE-2026-11645 is a severe out-of-bounds read/write bug in the V8 engine that is actively exploited via malicious webpages, and users should update to the recommended patch versions.
01002041.0K
4.2K followersView on X
Teegra 🧝‍♀️𝕏@Teeegra136d
Active Exploitation
گوگل به‌روزرسانی‌های امنیتی برای رفع ۷۴ آسیب‌پذیری منتشر کرد که یکی از آن‌ها در حال بهره‌برداری فعال در محیط واقعی است. این آسیب‌پذیری با شناسه CVE-2026-11645 و امتیاز CVSS معادل ۸.۸، به‌عنوان یک نقص دسترسی خارج از محدوده حافظه (out-of-bounds memory access) در موتور V8 کروم که مسئول پردازش جاوااسکریپت و WebAssembly است شناسایی شده و به مهاجم راه دور امکان می‌دهد از طریق یک صفحه HTML مخرب، کد دلخواه را درون محیط ایزوله (sandbox) اجرا کند. این نقص توسط محقق امنیتی با نام مستعار «303f06e3» در ۲۷ آوریل ۲۰۲۶ کشف و گزارش شده و جایزه‌ای معادل ۵۵,۰۰۰ دلار برای افشای مسئولانه آن پرداخت شده است. گوگل وجود اکسپلویت (exploit) فعال برای این آسیب‌پذیری را تأیید کرد، اما از ارائه جزئیات بیشتر برای جلوگیری از سوءاستفاده گسترده‌تر خودداری نمود. با این به‌روزرسانی، گوگل از ابتدای سال جاری در مجموع پنج آسیب‌پذیری روز-صفر (zero-day) فعال در کروم را برطرف کرده است. به کاربران توصیه می‌شود مرورگر کروم خود را به‌روزرسانی کنند. کاربران مرورگرهای مبتنی بر Chromium نظیر Microsoft Edge، Brave، Opera و Vivaldi نیز باید به‌محض انتشار، وصله‌های امنیتی مربوطه را اعمال نمایند.
Post summary
The text reports that CVE-2026-11645 is being actively exploited in Chrome’s V8 engine, Google confirmed an active exploit but withheld details, and urges users to apply the released patches.
0101771.5K
19.1K followersView on X
Yiğit@yigitech130d
Active Exploitation
Chrome'u acilen güncelleyin! Google, son güncellemede toplam 74 güvenlik açığını kapattı. Bunlardan en kritiği, aktif olarak saldırılarda kullanılan CVE-2026-11645 adlı bir zero-day zafiyeti. V8 JavaScript motorundaki bu açık, kötü amaçlı hazırlanmış bir web sayfasının ziyaret edilmesiyle saldırganların tarayıcı içinde keyfi kod çalıştırmasına olanak tanıyabiliyor. Yardım → Google Chrome Hakkında → Güncellemeleri Denetle
Post summary
The post urges a Chrome update, notes that CVE‑2026‑11645, a V8 RCE zero‑day, is actively exploited through malicious webpages, and confirms the update patches this issue.
2101283.1K
18.6K followersView on X
CiberBaur@BotBauR136d
Patch
Acaba de confirmarse: Google ha parcheado una vulnerabilidad de zero-day en Chrome, identificada como CVE-2026-11645, que está siendo explotada en el wild. Google ha liberado actualizaciones de seguridad para abordar 74 vulnerabilidades, incluyendo esta que ha sido descrita como un acceso a memoria fuera de límites en V8, el motor de JavaScript y WebAssembly de Chrome. La vulnerabilidad, con un puntaje CVSS de 8.8, permite la lectura y escritura fuera de límites en memoria, lo que puede llevar a la ejecución de código remoto. El vector principal de ataque es el contenido web especialmente diseñado, cargado en el contexto del navegador. El parche ya está disponible en versiones ≥149.0.7827.102/.103. Si usas Chrome, es crucial que actualices lo antes posible para evitar ser víctima de esta explotación activa. ¿Estás en riesgo? Revisa esto: asegúrate de tener la versión más reciente de Chrome instalada y mantén tus sistemas actualizados. #Ciberseguridad #CVE #SeguridadDigital #PYMEsMX https://thehackernews.com/2026/06/chrome-v8-zero-day-cve-2026-11645.html
Post summary
Google released a patch for CVE-2026-11645 after confirming active exploitation; the vulnerability involves out‑of‑bounds memory access in V8 with a CVSS score of 8.8, enabling remote code execution. Users must update Chrome to the latest version to mitigate the risk.
02073301
529 followersView on X
Nicolas Krassas@Dinosn136d
Active Exploitation
Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now https://thehackernews.com/2026/06/chrome-v8-zero-day-cve-2026-11645.html
Post summary
The headline alerts that CVE‑2026‑11645, a zero‑day flaw in Chrome’s V8 engine, is being actively exploited in the wild and stresses the urgency of applying the available patch.
02052914
158.9K followersView on X
Blue Team News@blueteamsec137d
Active Exploitation
Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now https://dlvr.it/TVWNYp #ChromeV8 #ZeroDay #CVE202611645 #CyberSecurity #InfoSec https://t.co/QaiajkEAu7
Post summary
The tweet announces that CVE-2026-11645 (Chrome V8 zero-day) is being actively exploited in the wild and urges immediate patching.
030501.6K
57.6K followersView on X
The Cyber Security Hub™@TheCyberSecHub136d
Active Exploitation
Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now https://thehackernews.com/2026/06/chrome-v8-zero-day-cve-2026-11645.html?utm_source=dlvr.it&utm_medium=twitter
Post summary
CVE‑2026‑11645, a zero‑day in Chrome V8, is being actively exploited; a patch is available now.
00043513
194.6K followersView on X
Xavier Rivera@XavierRiveraX136d
Patch
Google patched CVE-2026-11645, Chrome's fifth actively exploited zero-day of 2026. V8 reads and writes outside its memory bounds when parsing malicious HTML, enabling code execution inside the browser sandbox. Update Chrome now: 149.0.7827.102 (Win/Linux) or .103 (Mac).
Post summary
Google has released a patch for CVE-2026-11645, a previously actively exploited zero‑day that allows V8 to over‑read/write memory and escape the sandbox; users are advised to update to the specified Chrome versions.
02032418
597 followersView on X
Jamaica Cyber Incident Response Team (JaCIRT)@cirtgovjm133d
Active Exploitation
🚨URGENT ADVISORY 🚨 Update Chrome NOW! Google has fixed an actively exploited zero-day vulnerability (CVE-2026-11645). Apply updates immediately to reduce your risk. 🔗 https://cirt.gov.jm/advisory/google-releases-emergency-patch-actively-exploited-chrome-zero-day-vulnerability-cve-2026 #CberSecurity #Chrome #ZeroDay #InfoSec https://t.co/Qxa5H9BFkJ
Post summary
Google has patched an actively exploited zero‑day vulnerability (CVE-2026-11645) affecting Chrome; users should update immediately to mitigate risk.
03021178
1.2K followersView on X
transilienceai@transilienceai136d
Active Exploitation
You patched Chrome on every laptop. Did you patch the headless Chrome in your CI pipeline? CVE-2026-11645: a V8 zero-day already exploited in the wild : the 5th Chrome 0-day this year. Same engine renders untrusted HTML in your CI runners, where secrets live. Patch now. Full detailed advisory in comments.
Post summary
The post announces that CVE‑2026‑11645, a V8 zero‑day, is already being used in the wild and urges immediate patching, though it does not provide PoC or exploit code.
1112075
330 followersView on X
Clone Systems@CloneSystemsInc136d
Patch
Google has released a Chrome 149 security update addressing 74 vulnerabilities, including an actively exploited zero day tracked as CVE-2026-11645. The flaw is a high severity out of bounds read and write vulnerability in V8, Chrome’s JavaScript engine. According to available details, a remote attacker could exploit the issue with a specially crafted HTML page to execute arbitrary code inside the Chrome sandbox. While public details about the active exploitation remain limited, zero day activity against browser engines should be treated as high priority due to the role browsers play across enterprise environments, user workstations, cloud applications, identity workflows, and sensitive web sessions. Organizations should prioritize updating Chrome, validate endpoint patch status, review browser exposure across managed and unmanaged devices, and monitor for abnormal browser process behavior or suspicious web activity. Browser security is endpoint security. Delayed patching creates unnecessary exposure. #Cybersecurity #ChromeSecurity #GoogleChrome #ZeroDay #CVE202611645 #VulnerabilityManagement #PatchManagement #EndpointSecurity #ThreatIntelligence #BrowserSecurity
Post summary
Google released Chrome 149 to close 74 vulnerabilities, including CVE‑2026‑11645—a high‑severity, actively exploited zero‑day that lets attackers run arbitrary code via crafted HTML; users should update immediately and monitor browsers.
10021156
257 followersView on X
Decryption Digest ®@DecryptionDigst115d
Active Exploitation
CVSS 8.8 Chrome V8 zero-day CVE-2026-11645 confirmed active exploitation. 5th Chrome 0-day of 2026. 3.5B users at risk. Patch to 149.0.7827.103 now — visit About Chrome and relaunch. http://decryptiondigest.com #ChromeZeroDay #CISAKEV #PatchNow #ZeroDay #V8 #InfoSec https://t.co/io4dYNF6d7
Post summary
The Chrome V8 zero‑day CVE-2026-11645 (CVSS 8.8) is actively exploited; a patch 149.0.7827.103 is now available and users are urged to update.
10011144
26 followersView on X
DFIR Radar@DFIR_Radar135d
Active Exploitation
CVE-2026-11645 (CVSS 8.8) actively exploited Chrome V8 zero-day enables arbitrary code execution via crafted HTML pages. Google confirms exploit exists in wild. Update to Chrome 149.0.7827.102+ and force browser restart immediately. #DFIR_Radar https://t.co/E65w8VAYBl
Post summary
The tweet alerts that CVE-2026-11645 is actively exploited in the wild, enabling arbitrary code execution via crafted HTML pages, and advises users to update to Chrome 149.0.7827.102 or newer and restart the browser immediately.
11010237
1.6K followersView on X

CPE platform detail4 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

4 of 4 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	apple	macos	-	-	-
App	google	chrome	-	-	-
OS	linux	linux_kernel	-	-	-
OS	microsoft	windows	-	-	-

Explore more

Back to dashboard apple CVEs google CVEs linux CVEs chrome vulnerabilities

What researchers are saying

CVE-2026-11645

Tashita Software Security[verified]@TashitaSoftSecActive Exploitation

Google confirmed that CVE-2026-11645 is actively exploited, and the post shares a PoC video using a Mutation Plan, though no concrete exploit code is disclosed.

GovCERT.CZ[verified]@GOVCERT_CZActive Exploitation

Chrome CVE-2026-11645 is a severe out-of-bounds read/write bug in the V8 engine that is actively exploited via malicious webpages, and users should update to the recommended patch versions.

Teegra 🧝‍♀️𝕏[verified]@TeeegraActive Exploitation

The text reports that CVE-2026-11645 is being actively exploited in Chrome’s V8 engine, Google confirmed an active exploit but withheld details, and urges users to apply the released patches.

Yiğit[verified]@yigitechActive Exploitation

The post urges a Chrome update, notes that CVE‑2026‑11645, a V8 RCE zero‑day, is actively exploited through malicious webpages, and confirms the update patches this issue.

CiberBaur[verified]@BotBauRPatch

Google released a patch for CVE-2026-11645 after confirming active exploitation; the vulnerability involves out‑of‑bounds memory access in V8 with a CVSS score of 8.8, enabling remote code execution. Users must update Chrome to the latest version to mitigate the risk.

Nicolas Krassas[verified]@DinosnActive Exploitation

The headline alerts that CVE‑2026‑11645, a zero‑day flaw in Chrome’s V8 engine, is being actively exploited in the wild and stresses the urgency of applying the available patch.

Blue Team News[verified]@blueteamsec1Active Exploitation

The tweet announces that CVE-2026-11645 (Chrome V8 zero-day) is being actively exploited in the wild and urges immediate patching.

The Cyber Security Hub™[verified]@TheCyberSecHubActive Exploitation

CVE‑2026‑11645, a zero‑day in Chrome V8, is being actively exploited; a patch is available now.