CVE-2026-11645: The Fifth Chrome Zero-Day Exploited in 2026 and What It Means
CVE 2026 11645 is a high severity (CVSS 8.8) out of bounds read and write vulnerability in Chrome's V8 engine that allows remote code execution inside the browser sandbox, and it's already being actively exploited by... Chrome Stable versions 149.0.7827.102 (Windows, Linux) and 149.0.7827.103 (macOS) contain the fix...
Published byEdited with DeepSeek-V4-ProImages generated with GPT Image 1.5
CVE 2026 11645 is a high severity (CVSS 8.8) out of bounds read and write vulnerability in Chrome's V8 engine that allows remote code execution inside the browser sandbox, and it's already being actively exploited by...
Chrome Stable versions 149.0.7827.102 (Windows, Linux) and 149.0.7827.103 (macOS) contain the fix and address 74 total security issues, with the zero day reported by an anonymous researcher who received a $55,000 bug...
This is the fifth actively exploited Chrome zero day patched in 2026, following CVE 2026 2441, CVE 2026 3909, CVE 2026 3910, and CVE 2026 5281, showing an aggressive pattern of browser memory corruption attacks this y...
What are the details of the fifth Chrome zero-day exploited in 2026, including the CVE designation (CVE-2026-11645), its nature as an out-ofThe fifth Chrome zero-day of 2026 prompted an out-of-band emergency patch from Google after confirmation of active exploitation.
AI Prompt
Create a landscape editorial hero image for this Studio Global article: What are the details of the fifth Chrome zero-day exploited in 2026, including the CVE designation (CVE-2026-11645), its nature as an out-of. Article summary: Here are the confirmed details for **CVE-2026-11645**, the fifth Chrome zero-day exploited in the wild in 2026, along with verified sourcing for each claim.. Topic tags: general, general web, user generated. Reference image context from search candidates: Reference image 1: visual subject "# CVE-2026-11645, Chrome V8 Zero-Day in Active Exploitation. CVE-2026-11645 is not a routine Chrome bug buried inside a large browser update. Google’s June 8, 2026 Stable Channel r" source context "CVE-2026-11645, Chrome V8 Zero-Day in Active Exploitation" Reference image 2: visual subject "Google fixes the fifth actively exploited Chrome zero-day of 2026. U.S. CISA adds Berr
openai.com
Google has shipped an emergency out-of-band update for Chrome to close a zero-day vulnerability that attackers are already exploiting. The fix, released June 8–9, 2026, addresses CVE-2026-11645 — an out-of-bounds read and write bug in Chrome's V8 JavaScript and WebAssembly engine — alongside 73 other security issues. The flaw marks the fifth time this year that Google has had to rush a patch for a Chrome vulnerability under active exploitation.
A Closer Look at CVE-2026-11645
The core of the problem lies inside V8, the high-performance engine that executes JavaScript in Chrome and many other Chromium-based browsers. Google's official advisory describes CVE-2026-11645 as an "out of bounds memory access in V8," while the NIST National Vulnerability Database expands on this, classifying it as an out-of-bounds read and write issue . Attackers can leverage this memory-safety violation by crafting a malicious HTML page that, when loaded in an unpatched browser, allows execution of arbitrary code while staying inside Chrome's sandbox .
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
What is the short answer to "CVE-2026-11645: The Fifth Chrome Zero-Day Exploited in 2026 and What It Means"?
CVE 2026 11645 is a high severity (CVSS 8.8) out of bounds read and write vulnerability in Chrome's V8 engine that allows remote code execution inside the browser sandbox, and it's already being actively exploited by...
What are the key points to validate first?
CVE 2026 11645 is a high severity (CVSS 8.8) out of bounds read and write vulnerability in Chrome's V8 engine that allows remote code execution inside the browser sandbox, and it's already being actively exploited by... Chrome Stable versions 149.0.7827.102 (Windows, Linux) and 149.0.7827.103 (macOS) contain the fix and address 74 total security issues, with the zero day reported by an anonymous researcher who received a $55,000 bug...
What should I do next in practice?
This is the fifth actively exploited Chrome zero day patched in 2026, following CVE 2026 2441, CVE 2026 3909, CVE 2026 3910, and CVE 2026 5281, showing an aggressive pattern of browser memory corruption attacks this y...
CVE-2026-11645: The Fifth Chrome Zero-Day Exploited in 2026 and What It Means
CVE 2026 11645 is a high severity (CVSS 8.8) out of bounds read and write vulnerability in Chrome's V8 engine that allows remote code execution inside the browser sandbox, and it's already being actively exploited by... Chrome Stable versions 149.0.7827.102 (Windows, Linux) and 149.0.7827.103 (macOS) contain the fix...
Published byEdited with DeepSeek-V4-ProImages generated with GPT Image 1.5
CVE 2026 11645 is a high severity (CVSS 8.8) out of bounds read and write vulnerability in Chrome's V8 engine that allows remote code execution inside the browser sandbox, and it's already being actively exploited by...
Chrome Stable versions 149.0.7827.102 (Windows, Linux) and 149.0.7827.103 (macOS) contain the fix and address 74 total security issues, with the zero day reported by an anonymous researcher who received a $55,000 bug...
This is the fifth actively exploited Chrome zero day patched in 2026, following CVE 2026 2441, CVE 2026 3909, CVE 2026 3910, and CVE 2026 5281, showing an aggressive pattern of browser memory corruption attacks this y...
What are the details of the fifth Chrome zero-day exploited in 2026, including the CVE designation (CVE-2026-11645), its nature as an out-ofThe fifth Chrome zero-day of 2026 prompted an out-of-band emergency patch from Google after confirmation of active exploitation.
AI Prompt
Create a landscape editorial hero image for this Studio Global article: What are the details of the fifth Chrome zero-day exploited in 2026, including the CVE designation (CVE-2026-11645), its nature as an out-of. Article summary: Here are the confirmed details for **CVE-2026-11645**, the fifth Chrome zero-day exploited in the wild in 2026, along with verified sourcing for each claim.. Topic tags: general, general web, user generated. Reference image context from search candidates: Reference image 1: visual subject "# CVE-2026-11645, Chrome V8 Zero-Day in Active Exploitation. CVE-2026-11645 is not a routine Chrome bug buried inside a large browser update. Google’s June 8, 2026 Stable Channel r" source context "CVE-2026-11645, Chrome V8 Zero-Day in Active Exploitation" Reference image 2: visual subject "Google fixes the fifth actively exploited Chrome zero-day of 2026. U.S. CISA adds Berr
openai.com
Google has shipped an emergency out-of-band update for Chrome to close a zero-day vulnerability that attackers are already exploiting. The fix, released June 8–9, 2026, addresses CVE-2026-11645 — an out-of-bounds read and write bug in Chrome's V8 JavaScript and WebAssembly engine — alongside 73 other security issues. The flaw marks the fifth time this year that Google has had to rush a patch for a Chrome vulnerability under active exploitation.
A Closer Look at CVE-2026-11645
The core of the problem lies inside V8, the high-performance engine that executes JavaScript in Chrome and many other Chromium-based browsers. Google's official advisory describes CVE-2026-11645 as an "out of bounds memory access in V8," while the NIST National Vulnerability Database expands on this, classifying it as an out-of-bounds read and write issue . Attackers can leverage this memory-safety violation by crafting a malicious HTML page that, when loaded in an unpatched browser, allows execution of arbitrary code while staying inside Chrome's sandbox .
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
What is the short answer to "CVE-2026-11645: The Fifth Chrome Zero-Day Exploited in 2026 and What It Means"?
CVE 2026 11645 is a high severity (CVSS 8.8) out of bounds read and write vulnerability in Chrome's V8 engine that allows remote code execution inside the browser sandbox, and it's already being actively exploited by...
What are the key points to validate first?
CVE 2026 11645 is a high severity (CVSS 8.8) out of bounds read and write vulnerability in Chrome's V8 engine that allows remote code execution inside the browser sandbox, and it's already being actively exploited by... Chrome Stable versions 149.0.7827.102 (Windows, Linux) and 149.0.7827.103 (macOS) contain the fix and address 74 total security issues, with the zero day reported by an anonymous researcher who received a $55,000 bug...
What should I do next in practice?
This is the fifth actively exploited Chrome zero day patched in 2026, following CVE 2026 2441, CVE 2026 3909, CVE 2026 3910, and CVE 2026 5281, showing an aggressive pattern of browser memory corruption attacks this y...
The vulnerability carries a CVSS score of 8.8, landing it in the "high severity" category . For users, a successful attack means an adversary can run code on their system at the privilege level of the browser process — typically enough to install malware, steal data, or pivot to additional exploits. While Google's disclosure uses the standard phrasing that the bug "allowed a remote attacker to execute arbitrary code inside a sandbox," the nature of out-of-bounds read/write primitives also makes techniques like ASLR bypass practical for attackers seeking deeper system compromise .
Patch Details and Timeline
The emergency patch was pushed through the Stable Desktop channel on June 8, 2026, as part of a broader release that corrects 74 security vulnerabilities in a single update . Google confirmed that an exploit for CVE-2026-11645 "exists in the wild," which makes this an urgent, must-apply update for anyone running Chrome on desktop .
The patched versions are:
Windows and macOS: Chrome 149.0.7827.102 / 149.0.7827.103
Linux: Chrome 149.0.7827.102
As is standard for Chrome Stable updates, the fix rolls out progressively over days and weeks, though users can manually trigger the update through Chrome menu > Help > About Google Chrome.
Bug Bounty and Disclosure
An anonymous security researcher operating under the handle "303f06e3" discovered and reported the vulnerability to Google on April 27, 2026 . Google issued a $55,000 bounty for the finding, consistent with the Chrome Vulnerability Rewards Program's reward tiers for high-impact V8 memory corruption bugs . While Google's official Chrome Releases blog post for this cycle includes the bounty amount in its summary, the company typically does not break down bounty figures for every individual vulnerability in its security advisories .
The Broader 2026 Chrome Zero-Day Picture
With CVE-2026-11645, Chrome has now seen five actively exploited zero-days patched in 2026 alone . The full list before June shows an accelerating tempo of in-the-wild browser exploits:
CVE-2026-2441 (February 2026): A use-after-free flaw in Chrome's CSS processing that allowed remote code execution inside the sandbox via crafted HTML pages .
CVE-2026-3909 (March 12, 2026): An out-of-bounds write vulnerability in Skia, the 2D graphics library that underpins Chrome's rendering pipeline .
CVE-2026-3910 (March 12, 2026): An inappropriate implementation bug in V8 that allowed arbitrary code execution inside the browser sandbox, patched in the same release as CVE-2026-3909 .
CVE-2026-5281 (April 1, 2026): A use-after-free bug in Dawn, Chrome's cross-platform WebGPU implementation, which CISA added to its Known Exploited Vulnerabilities catalog with a deadline for federal agencies to patch .
CVE-2026-11645 (June 2026): The V8 out-of-bounds read/write zero-day patched in this emergency update .
All five vulnerabilities were confirmed as exploited in the wild before patches shipped — a pattern that puts 2026 on track to exceed Google's total Chrome zero-day count from previous years. Multiple sources covering the patching cycle note that each month's disclosure now frequently includes at least one actively exploited bug, placing sustained pressure on IT teams to shorten their patch cycles for browser software .
What Users Should Do Now
Chrome typically updates itself in the background, but the automatic rollout can take days to reach every user. For immediate protection, open Chrome, go to the three-dot menu in the top-right corner, select Help > About Google Chrome, and allow the browser to check for and apply any available update. The version number should read 149.0.7827.102 or higher on Windows and Linux, and 149.0.7827.103 or higher on macOS .
Organizations managing Chrome deployments should verify that all endpoints are receiving the latest stable release and consider accelerating deployment timelines for this out-of-band patch. The confirmed in-the-wild exploitation status means any system running an earlier version of Chrome remains exposed to active attack.
The vulnerability carries a CVSS score of 8.8, landing it in the "high severity" category . For users, a successful attack means an adversary can run code on their system at the privilege level of the browser process — typically enough to install malware, steal data, or pivot to additional exploits. While Google's disclosure uses the standard phrasing that the bug "allowed a remote attacker to execute arbitrary code inside a sandbox," the nature of out-of-bounds read/write primitives also makes techniques like ASLR bypass practical for attackers seeking deeper system compromise .
Patch Details and Timeline
The emergency patch was pushed through the Stable Desktop channel on June 8, 2026, as part of a broader release that corrects 74 security vulnerabilities in a single update . Google confirmed that an exploit for CVE-2026-11645 "exists in the wild," which makes this an urgent, must-apply update for anyone running Chrome on desktop .
The patched versions are:
Windows and macOS: Chrome 149.0.7827.102 / 149.0.7827.103
Linux: Chrome 149.0.7827.102
As is standard for Chrome Stable updates, the fix rolls out progressively over days and weeks, though users can manually trigger the update through Chrome menu > Help > About Google Chrome.
Bug Bounty and Disclosure
An anonymous security researcher operating under the handle "303f06e3" discovered and reported the vulnerability to Google on April 27, 2026 . Google issued a $55,000 bounty for the finding, consistent with the Chrome Vulnerability Rewards Program's reward tiers for high-impact V8 memory corruption bugs . While Google's official Chrome Releases blog post for this cycle includes the bounty amount in its summary, the company typically does not break down bounty figures for every individual vulnerability in its security advisories .
The Broader 2026 Chrome Zero-Day Picture
With CVE-2026-11645, Chrome has now seen five actively exploited zero-days patched in 2026 alone . The full list before June shows an accelerating tempo of in-the-wild browser exploits:
CVE-2026-2441 (February 2026): A use-after-free flaw in Chrome's CSS processing that allowed remote code execution inside the sandbox via crafted HTML pages .
CVE-2026-3909 (March 12, 2026): An out-of-bounds write vulnerability in Skia, the 2D graphics library that underpins Chrome's rendering pipeline .
CVE-2026-3910 (March 12, 2026): An inappropriate implementation bug in V8 that allowed arbitrary code execution inside the browser sandbox, patched in the same release as CVE-2026-3909 .
CVE-2026-5281 (April 1, 2026): A use-after-free bug in Dawn, Chrome's cross-platform WebGPU implementation, which CISA added to its Known Exploited Vulnerabilities catalog with a deadline for federal agencies to patch .
CVE-2026-11645 (June 2026): The V8 out-of-bounds read/write zero-day patched in this emergency update .
All five vulnerabilities were confirmed as exploited in the wild before patches shipped — a pattern that puts 2026 on track to exceed Google's total Chrome zero-day count from previous years. Multiple sources covering the patching cycle note that each month's disclosure now frequently includes at least one actively exploited bug, placing sustained pressure on IT teams to shorten their patch cycles for browser software .
What Users Should Do Now
Chrome typically updates itself in the background, but the automatic rollout can take days to reach every user. For immediate protection, open Chrome, go to the three-dot menu in the top-right corner, select Help > About Google Chrome, and allow the browser to check for and apply any available update. The version number should read 149.0.7827.102 or higher on Windows and Linux, and 149.0.7827.103 or higher on macOS .
Organizations managing Chrome deployments should verify that all endpoints are receiving the latest stable release and consider accelerating deployment timelines for this out-of-band patch. The confirmed in-the-wild exploitation status means any system running an earlier version of Chrome remains exposed to active attack.
