CVE-2026-11645: Chrome V8 Out-of-Bounds Memory Access Remote Code Execution

Technical summary

CVE-2026-11645 is an out-of-bounds (OOB) memory access vulnerability in V8, Chrome's JavaScript engine. The flaw combines CWE-125 (out-of-bounds read) and CWE-787 (out-of-bounds write), enabling an attacker to manipulate memory outside the bounds of an allocated object. A specially crafted HTML document can trigger this condition, allowing code execution within the sandbox. The vulnerability affects Chrome versions prior to 149.0.7827.103. While sandboxed, exploitation still enables attackers to exfiltrate data accessible to the browser process and potentially pivot to further system compromise.

Business impact

Organizations relying on Chrome for web applications face elevated risk of data theft and malware infection through drive-by compromises. Employees visiting untrusted or compromised websites could have credentials, session tokens, and locally stored sensitive information stolen. In enterprise environments where Chrome handles confidential work, this becomes a vector for intellectual property loss and lateral movement into internal systems. The requirement for user interaction means phishing campaigns and malicious advertisements become practical attack surfaces.

Affected systems

Google Chrome prior to version 149.0.7827.103 is the primary affected application. Because V8 is also used in Chromium-based browsers and embedded contexts, organizations should verify whether other Chromium derivatives in their environment require updates. The vulnerability is OS-agnostic; Windows, macOS, and Linux systems running vulnerable Chrome versions are at risk. Verify patch status across your entire browser deployment.

Exploitability

The vulnerability is actively exploited (KEV listed). Exploitation requires delivery of a crafted HTML page to a user and their interaction with it—a low barrier given email, messaging, web advertising, and compromised websites as vectors. No special privileges or complex user actions beyond visiting or opening a link are needed. The practical exploitability is high, making this a priority for rapid remediation. The sandbox limits blast radius but does not eliminate risk.

Remediation

Update Google Chrome to version 149.0.7827.103 or later immediately. Enable automatic updates if not already configured. For enterprise deployments, prioritize Chrome update policies and verify rollout completion within your KEV due date (June 23, 2026). Inventory any Chromium-based browsers or embedded V8 contexts and apply patches accordingly. Consider temporary mitigations such as disabling JavaScript or restricting browsing to trusted domains for high-risk users pending full patching.

Patch guidance

Google Chrome releases should be applied automatically via the built-in update mechanism. Verify that Chrome has updated to 149.0.7827.103 or later by navigating to Chrome menu > About Google Chrome, which will display the current version and apply pending updates. For managed deployments, use your organization's Chrome management policy or Mobile Device Management (MDM) solution to enforce the patch. Test in a non-production environment first if your organization has complex web application dependencies. Confirm rollout completion before the KEV due date (June 23, 2026).

Detection guidance

Monitor for Chrome crashes or unusual JavaScript errors in browser consoles—exploitation attempts may leave traces. Watch for unexpected network traffic from Chrome processes, particularly connections to unknown external domains. Endpoint Detection and Response (EDR) tools should flag process creation or code injection attempts originating from Chrome sandbox escapes. Review browser security logs for policy violations. Conduct user awareness training to reduce phishing and malicious site visits. Network-level detection is difficult because the payload is embedded in HTML; focus on patch validation and user behavior monitoring.

Why prioritize this

This vulnerability combines a high CVSS score (8.8), active exploitation (KEV listed), and low attack complexity (remote, no authentication, user interaction only). The short KEV due date (14 days from publication) reflects assessed exploit maturity and threat prevalence. Sandboxing limits immediate system-level compromise but does not prevent data theft or further pivots. Rapid patching is essential to prevent credential compromise and lateral movement in enterprise environments.

Risk score, explained

CVSS 8.8 (HIGH) reflects the combination of network accessibility (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), user interaction needed (UI:R), and high impact across confidentiality, integrity, and availability. While the sandbox constraint is not quantified in CVSS, it is a real mitigation; however, in-browser data (cookies, local storage, cached credentials) remains exposed. The KEV listing indicates active real-world exploitation, elevating practical risk beyond the base CVSS score.

Frequently asked questions