Summary
Google has released an emergency update for Chrome to address CVE-2026-11645, an actively exploited zero-day vulnerability in the V8 JavaScript and WebAssembly engine. The flaw is an out-of-bounds read and write issue that allows a remote attacker to execute arbitrary code within Chrome’s sandbox simply by luring a victim to a malicious webpage. It has been assigned a CVSS score of 8.8 (High).
The vulnerability affects Chrome versions prior to 149.0.7827.103 and impacts all Chromium-based browsers including Microsoft Edge, Brave, and Opera. CISA has added CVE-2026-11645 to its Known Exploited Vulnerabilities catalog with a remediation deadline of June 23, 2026. The bug was originally reported by researcher “303f06e3” on April 27, earning a $55,000 bounty.
This marks the fifth actively exploited Chrome zero-day in 2026 alone, continuing a trend of V8 engine flaws being targeted for initial access. While the exploit runs inside Chrome’s sandbox, attackers could chain it with a sandbox escape for full system compromise.
Sources
- The Hacker News — Chrome V8 Zero-Day CVE-2026-11645
- SecurityWeek — Google Patches 5th Chrome Zero-Day Exploited in 2026
- SOC Prime — CVE-2026-11645 Chrome Zero-Day Exploited in the Wild
Commentary
Five Chrome zero-days in six months is an ugly trend. V8 continues to be a favorite target for attackers because the JavaScript engine is enormously complex and processes untrusted input constantly. Google’s layered sandbox model buys time, but chaining sandbox escapes is a well-practiced art among advanced threat actors — the sandbox is a speed bump, not a wall.
The real concern for enterprise defenders: Chromium’s dominance means this flaw touches Chrome, Edge, Brave, Opera, and countless Electron-based apps. If your patch management doesn’t cover all those variants, you’re leaving doors open. Update everything Chromium-based immediately.