CVE-2026-11645 is an out-of-bounds read/write bug in Chrome's V8 JavaScript engine that let a remote attacker run arbitrary code inside the renderer sandbox via a crafted HTML page, and Google shipped the fix as an emergency Stable Channel update after confirming exploitation in the wild.
Vulnerability summary
8.8
High
2.4%
EPSS score (FIRST)
Yes
CISA KEV catalog
2026-06-09
Published
Vulnerability ID: CVE-2026-11645 · Source: Chrome CNA (not NVD-confirmed)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Google Chrome (Windows, macOS, Linux) | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | before 149.0.7827.102 (Linux) / 149.0.7827.102-.103 (Windows, macOS); fixed in 149.0.7827.102/.103 |
What this means
CVE-2026-11645 is an out-of-bounds read and write vulnerability (CWE-125 Out-of-bounds Read, CWE-787 Out-of-bounds Write) in V8, the JavaScript and WebAssembly engine used by Google Chrome and other Chromium-based browsers. NVD's description, quoting Google's own advisory text, states: "Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page" (NVD).
NVD lists only a Secondary CVSS v3.1 score from the Chrome CNA (source identifier 134c704f-9b21-4f2e-91b3-4a467353bcc0): base score 8.8 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — network-reachable, low complexity, no privileges required, but user interaction (visiting the crafted page) is needed. NVD's status is "Analyzed," with no NVD Primary metric published, so this score is labelled not NVD-confirmed on this page (NVD).
Google's Chrome Releases blog announced the fix on 2026-06-08: a Stable Channel update to 149.0.7827.102/.103 for Windows and Mac and 149.0.7827.102 for Linux, rolling out over the following days and weeks, as part of a release that bundled 74 total security fixes. Google's release notes access restrictions on bug detail until a majority of users are updated, standard practice for actively exploited issues (Chrome Releases: Stable Channel Update for Desktop).
CISA added CVE-2026-11645 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-06-09, with a required-action due date of 2026-06-23, confirmed present in the live KEV catalog's CVE-filtered view this run — this was the fifth Chrome V8 zero-day patched in 2026 (CISA KEV).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.0244 (84.285th percentile) — a modest absolute figure typical of browser-renderer bugs that need a user to visit a malicious page, but still well above the median CVE despite the issue being patched for months (FIRST EPSS).
Any Chrome (or other Chromium-based browser) installation on a version before 149.0.7827.102/.103 should be updated and fully relaunched immediately; organizations should push the update via Chrome Browser Cloud Management or equivalent endpoint tooling rather than waiting on auto-update, given the confirmed in-the-wild exploitation.
Evidence
- Out-of-bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. — NVD
- NVD lists only a Secondary CVSS v3.1 score of 8.8 (high) from the Chrome CNA, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; no NVD Primary metric is published. — NVD
- Stable Channel updated to 149.0.7827.102/.103 (Windows/Mac) and 149.0.7827.102 (Linux) on 2026-06-08, bundled with 74 total security fixes. — Chrome Releases: Stable Channel Update for Desktop
- Added to the CISA KEV catalog on 2026-06-09, required-action due date 2026-06-23. — CISA KEV
- EPSS score is 0.0244 (84.285th percentile) as of 2026-10-30. — FIRST EPSS
