Chrome V8 Zero-Day CVE-2026-11645 Is Being Actively Exploited: Update Now

Google has confirmed that a zero-day vulnerability in Chrome's V8 JavaScript engine is being actively exploited in the wild. The flaw, tracked as CVE-2026-11645, is an out-of-bounds read and write issue in V8, the engine responsible for executing JavaScript and WebAssembly in the Chrome browser, that allows an attacker who can get a user to visit a crafted HTML page to execute arbitrary code within the Chrome renderer process. The vulnerability carries a CVSS score of 8.8 and was reported to Google on 27 April 2026 by an anonymous security researcher, who received a $55,000 bug bounty for responsible disclosure.

Google released an emergency update for Chrome on desktop on 9 June 2026. Users running Chrome below version 149.0.7827.102 on Windows and Linux, or below 149.0.7827.103 on macOS, are affected. The update is being rolled out automatically, but enterprise environments using managed deployments, or users who have disabled automatic updates, must verify their version and apply the patch manually. Version confirmation is available by navigating to chrome://settings/help, which also triggers an update check.

What CVE-2026-11645 Does

Out-of-bounds read and write vulnerabilities in JavaScript engines arise when the engine accesses memory outside the region it is permitted to use, which can expose sensitive data, corrupt internal data structures, or create a path to code execution. In V8, this class of flaw can allow an attacker to achieve memory corruption in the renderer process, the sandboxed component of Chrome responsible for parsing and executing web content.

While the renderer sandbox limits the direct impact of a successful exploit, out-of-bounds memory access flaws in V8 are frequently chained with a second vulnerability, typically a sandbox escape, to achieve broader code execution on the underlying operating system. Security researchers at BleepingComputer and SecurityWeek note that CVE-2026-11645 can also help attackers bypass ASLR, the address space layout randomisation protection built into modern operating systems, potentially making a chained exploit easier to construct. Google has withheld full technical details of CVE-2026-11645 while the patch reaches the majority of users, which is standard practice to limit the exploitation window.

CVE-2026-11645 is the fifth Chrome zero-day that Google has patched in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281. The frequency of these disclosures reflects both the complexity of the V8 engine and the sustained interest of advanced threat actors in browser-based initial access, which bypasses perimeter controls entirely and targets the endpoint at the application layer.

CISA Known Exploited Vulnerabilities Listing

CISA added CVE-2026-11645 to its Known Exploited Vulnerabilities catalog on 9 June 2026. US federal agencies are required to remediate by 23 June 2026. For GCC enterprises operating in regulated sectors or those supplying to government-adjacent entities, the KEV listing is a meaningful prioritisation signal: it represents a formal determination that the vulnerability is being actively weaponised against real targets, not a theoretical risk.

What GCC Security Teams Must Do Now

The remediation step is straightforward: update Chrome. On managed endpoints, IT and security teams should verify that Chrome version 149.0.7827.102 or later is installed across all devices.

For organisations using Google Chrome Enterprise, the update should be pushed via the management console immediately, prioritising internet-facing workstations and any endpoint used for privileged access to internal systems.

Organisations that operate web filtering or proxy infrastructure should verify that traffic inspection does not interfere with the delivery of Chrome updates from Google's update servers.

Microsoft Edge, which is built on the same Chromium engine as Chrome, has released version 149.0.4022.62 of Edge Stable specifically to address CVE-2026-11645. Edge users and administrators in Saudi Arabia and across the Gulf should verify their browser version and apply the available update as a parallel action alongside Chrome patching.

Electron applications, headless Chrome instances in development pipelines, and other software embedding Chromium runtimes may carry their own V8 builds and require separate verification. A response that only checks the browser icon on employee laptops will miss this exposure.

The pattern of simultaneous multi-layer targeting that GCC security teams are navigating this month is significant. The Check Point VPN authentication bypass campaign exploiting CVE-2026-50751 demonstrated attackers targeting network perimeter infrastructure, while CVE-2026-11645 targets the endpoint at the browser layer. The concurrent Linux kernel privilege escalation flaw CVE-2026-23111, for which a public working exploit has been available since April, adds a third layer of exposure for organisations running Linux-based server infrastructure. Patch cadence across all three layers, network, endpoint, and operating system, is the only reliable defensive posture.