A out-of-bounds read and write bug in Chrome's V8 JavaScript engine lets a remote attacker run arbitrary code inside the browser sandbox through a crafted web page, and CISA has added it to its Known Exploited Vulnerabilities catalog.
What Is It
CVE-2026-11645 is an out-of-bounds read and write vulnerability (CWE-125 and CWE-787) in V8, the JavaScript engine used by Google Chrome and other Chromium-based browsers. According to Google's advisory, a crafted HTML page can trigger the flaw, allowing a remote attacker to execute arbitrary code inside the renderer sandbox. It carries a CVSS 3.1 base score of 8.8 (High) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges required, but needing user interaction such as visiting a malicious page.
Why It Matters
CISA added CVE-2026-11645 to its Known Exploited Vulnerabilities catalog on 2026-06-09, signaling it warrants priority attention. The bug requires only that a victim load a malicious page, and its high confidentiality, integrity, and availability impacts mean a successful exploit can fully compromise the affected process. Because Chromium underpins many browsers, the attack surface is broad. Known ransomware campaign use is currently listed as Unknown.
What's Vulnerable
Google Chrome prior to version 149.0.7827.103 is affected. The underlying V8 flaw extends beyond Chrome: per CISA, it could affect multiple browsers built on Chromium, including but not limited to Google Chrome, Microsoft Edge, and Opera. The CPE data covers Chrome running on Windows, macOS, and Linux.
Patch Status
Google has fixed the issue in the Stable channel; Chrome builds at or above 149.0.7827.103 are patched. CISA's required action: apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. The remediation due date is 2026-06-23. Users of other Chromium-based browsers should apply their respective vendor updates.