CVE-2026-11075: Out-of-Bounds Read in Chrome V8 Engine – Memory Disclosure Vulnerability

Technical summary

CVE-2026-11075 is an out-of-bounds read vulnerability in the V8 JavaScript engine (CWE-125) that affects Google Chrome prior to version 149.0.7827.53. The flaw permits remote code execution context to access memory beyond the intended bounds of an object or buffer, allowing information disclosure. The vulnerability is triggered through malicious HTML delivered to a user's browser and has a CVSS 3.1 score of 6.5 (Medium severity), reflecting high confidentiality impact but no integrity or availability compromise. The attack vector is network-based with low attack complexity and requires only user interaction (visiting a webpage) to succeed.

Business impact

Data exfiltration is the primary risk: attackers can extract sensitive information from browser memory without requiring user passwords or multi-factor authentication bypass. For organizations where Chrome is the primary or mandated browser, this creates a pathway for credential theft, API key exposure, or proprietary data leakage. The requirement for user interaction (visiting a malicious site) makes phishing, watering-hole attacks, or ad-injection campaigns the likely delivery vectors. The business impact depends on user awareness and browser policy controls; users who avoid suspicious links face lower risk, but determined social engineering or compromised legitimate sites present serious exposure.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are directly affected. The vulnerability manifests on all operating systems where Chrome runs: Windows, macOS, and Linux. The CVE entry lists Linux kernel as an affected product in the taxonomy, though the vulnerability is a Chrome-specific memory safety issue rather than a kernel-level flaw; patching Chrome itself is the remediation. Organizations running older Chrome instances on any supported OS are at risk.

Exploitability

Exploitation requires network access and user interaction—specifically, convincing a user to visit or be redirected to a malicious HTML page. No authentication or elevated privileges are needed. The attack complexity is low, meaning straightforward HTML and JavaScript can trigger the out-of-bounds read. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the available data, indicating no confirmed in-the-wild exploitation at the time of disclosure; however, the low barrier to exploitation and the attractiveness of memory-disclosure attacks mean active exploitation could emerge rapidly if proof-of-concept details are published.

Remediation

Update Google Chrome to version 149.0.7827.53 or later on all affected systems. Chrome's auto-update mechanism should deploy the patch automatically on most systems, but verification is recommended in enterprise environments. For macOS and Linux deployments, ensure that browser update policies are enforced and that users are not blocked from receiving security updates. Verify successful patching by checking the browser version in Chrome settings (chrome://settings/help).

Patch guidance

Google Chrome typically rolls out security updates across stable, beta, and developer channels. Organizations should monitor Chrome's release notes or security advisories for confirmation that version 149.0.7827.53 includes this fix. If using Chrome in an enterprise environment with update policies, ensure that blocking or deferring updates does not prevent this security patch from being applied. Test the patched version in a non-production environment if your organization requires change control. Users on personal devices should allow Chrome to auto-update; if manual updates are necessary, visit chrome://settings/help to trigger an immediate check.

Detection guidance

Detection of exploitation attempts is challenging because the attack occurs entirely within a browser process and leaves minimal forensic traces without specialized instrumentation. Network-level detection: monitor for users visiting known-malicious domains or sudden DNS lookups to suspicious hosts that might host exploit pages. Endpoint detection: Chrome may log crash reports if the out-of-bounds read causes instability; review Chrome's crash reporter logs (if enabled) for unexpected memory access violations. Browser history analysis on compromised systems may reveal visits to exploit pages. Process-level monitoring tools can detect unusual V8 memory access patterns, but this requires advanced endpoint detection and response (EDR) tooling configured to track JavaScript engine behavior. User education on avoiding phishing and watering-hole sites remains a practical defense.

Why prioritize this

This vulnerability merits timely patching due to the combination of ease of exploitation and high confidentiality impact. The CVSS score of 6.5 reflects 'Medium' severity, but the practical risk depends on organizational context: high-sensitivity environments handling credentials or intellectual property should prioritize this patch within days; general-population browsers can follow standard patch cycles (within 1-2 weeks). The lack of KEV designation suggests it is not yet actively exploited at scale, providing a window to patch before opportunistic campaigns leverage proof-of-concept code.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects: (1) network attack vector—anyone on the internet can craft and host an exploit page; (2) low attack complexity—no special setup or rare conditions needed; (3) no privilege requirement; (4) user interaction required—the target must visit the malicious page; (5) high confidentiality impact—sensitive memory contents can be read; (6) no integrity or availability impact—data cannot be modified and the process typically does not crash. The score appropriately captures that this is a serious information-disclosure flaw for its users, but not a remote code execution or system-level threat. Organizations with defense-in-depth controls (Content Security Policy, browser isolation, endpoint detection) may effectively lower realized risk below the base score.

Frequently asked questions