Google Chrome V8 Out-of-Bounds Read/Write Zero-Day CVE-2026-11645 Exploited in the Wild
Google Chrome V8 Out-of-Bounds Read/Write Zero-Day (TL-2026-0725), also tracked as Fifth Chrome Zero-Day of 2026, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-06-09. It has no confirmed attribution, affects Google Chrome, references 1 CVE (CVE-2026-11645), maps to 15 MITRE ATT&CK techniques (T1027, T1041, T1059), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-0725
- Threat ID
- TL-2026-0725
- Also known as
- Fifth Chrome Zero-Day of 2026
- Severity
- HIGH
- CVSS
- 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-06-09
- Last reviewed
- 2026-06-09
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- all sectors, government, technology, financial, media, civil society
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 19
CVE-2026-11645 is a high-severity out-of-bounds read/write vulnerability in the V8 JavaScript/WebAssembly engine of Google Chrome, actively exploited as a zero-day. A remote attacker can achieve arbitrary code execution inside the renderer sandbox via a crafted HTML page. It is the fifth actively exploited Chrome zero-day of 2026 and affects Chrome prior to 149.0.7827.103 and all Chromium-based browsers.
How Google Chrome V8 Out-of-Bounds Read/Write Zero-Day works
CVE-2026-11645 is an out-of-bounds (OOB) read and write memory-corruption vulnerability in V8, the JavaScript and WebAssembly engine that powers Google Chrome and all Chromium-derived browsers. Google confirmed on June 9, 2026 that an exploit for the flaw exists in the wild, making it the fifth actively exploited Chrome zero-day fixed in 2026. The NVD records the flaw under CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write) with a CVSS 3.1 base score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Exploitation requires only that a victim visit an attacker-controlled or compromised web page. A maliciously crafted HTML/JavaScript payload triggers the OOB condition in V8 — typically by corrupting the bounds metadata of a JavaScript object such as a TypedArray/ArrayBuffer, or by abusing a JIT/type-confusion primitive in TurboFan/Maglev — yielding an attacker-controlled relative or absolute read/write primitive. The OOB read leaks adjacent heap memory (enabling an ASLR/heap-layout bypass and information disclosure), while the OOB write enables heap corruption that is escalated to arbitrary code execution inside the renderer process sandbox. Because the renderer remains sandboxed, real-world weaponization of a V8 RCE is generally chained with a separate sandbox-escape vulnerability to obtain code execution with full user privileges on the host.
Google's Threat Analysis Group (TAG) has historically identified Chrome zero-days used by commercial spyware vendors and state-aligned operators, but Google has not publicly attributed CVE-2026-11645 or the other four 2026 Chrome zero-days to any specific APT or spyware campaign, and withheld bug details and the exploit's technical specifics until a majority of users are patched. The vulnerability was reported on April 27, 2026 by an anonymous external researcher tracked as '303f06e3', who received a $55,000 bug bounty. The fix shipped in Chrome Stable 149.0.7827.102/.103 for Windows and macOS and 149.0.7827.102 for Linux as part of a broader update addressing 74 total vulnerabilities. CVE-2026-11645 follows CVE-2026-2441 (CSSFontFeatureValuesMap iterator invalidation, February), CVE-2026-3909 (OOB write in the Skia graphics library, March), CVE-2026-3910 (inappropriate implementation in V8, March), and CVE-2026-5281 (use-after-free in the Dawn/WebGPU component, April). Coverage notes the 2026 surge in discovered Chrome bugs is likely driven in part by AI-assisted vulnerability research.
MITRE ATT&CK techniques used in TL-2026-0725
Defense Evasion
T1027 Obfuscated Files or Information; T1211 Exploitation for Stealth
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol
Discovery
T1082 System Information Discovery; T1518 Software Discovery
Collection
T1185 Browser Session Hijacking
Initial Access
Credential Access
T1539 Steal Web Session Cookie
Resource Development
T1583 Acquire Infrastructure; T1587 Develop Capabilities
Reconnaissance
Affected products and versions in Google Chrome V8 Out-of-Bounds Read/Write Zero-Day
- Google — Chrome
Vulnerable versions: < 149.0.7827.103
Fixed in: 149.0.7827.103 (Windows/macOS); 149.0.7827.102 (Linux) - Microsoft — Edge (Chromium)
Vulnerable versions: builds prior to V8 fix
Fixed in: vendor security release incorporating V8 patch - Brave Software — Brave
Vulnerable versions: builds prior to V8 fix
Fixed in: vendor security release incorporating V8 patch - Opera — Opera
Vulnerable versions: builds prior to V8 fix
Fixed in: vendor security release incorporating V8 patch - Vivaldi — Vivaldi
Vulnerable versions: builds prior to V8 fix
Fixed in: vendor security release incorporating V8 patch
Remediation for Google Chrome V8 Out-of-Bounds Read/Write Zero-Day
Patches
- Google Chrome Stable 149.0.7827.103 (Windows/macOS) / 149.0.7827.102 (Linux)
- Corresponding security releases for Microsoft Edge, Brave, Opera, and Vivaldi
Immediate actions
- Update Google Chrome to 149.0.7827.102/.103 (Windows/macOS) or 149.0.7827.102 (Linux) immediately and relaunch the browser to apply the fix
- Patch all Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi) once their vendors ship the corresponding builds
- Verify enterprise fleets via management policy that Chrome auto-update is enabled and not pinned to a vulnerable build
Workarounds
- Until patched, restrict browsing to trusted sites and consider disabling JavaScript/WebAssembly for untrusted origins
- Use network web filtering to block known malicious/drive-by domains
Longer-term hardening
- Enforce automatic browser updates across managed endpoints via group policy / MDM
- Deploy EDR with browser-process behavioral detection (renderer crash and child-process anomaly monitoring)
- Enable Chrome Site Isolation and the V8 sandbox/hardening flags where configurable
- Adopt Chrome Enterprise security baselines and restrict legacy/unmanaged browser versions from the network
CVEs associated with Google Chrome V8 Out-of-Bounds Read/Write Zero-Day
CVE-2026-11645
Weaknesses (CWE) in Google Chrome V8 Out-of-Bounds Read/Write Zero-Day
CWE-125, CWE-787
Timeline of Google Chrome V8 Out-of-Bounds Read/Write Zero-Day
- CVE-2026-2441, an iterator-invalidation flaw in CSSFontFeatureValuesMap, becomes the first actively exploited Chrome zero-day of 2026 (February).
- CVE-2026-3909 (out-of-bounds write in the Skia 2D graphics library) and CVE-2026-3910 (inappropriate implementation in V8) are patched as exploited zero-days (March).
- CVE-2026-5281, a use-after-free in the Dawn/WebGPU component, becomes the fourth exploited Chrome zero-day of 2026 (April).
- An anonymous external researcher tracked as '303f06e3' reports CVE-2026-11645 to the Google Chrome security team; later awarded a $55,000 bug bounty.
- Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi) begin shipping security releases incorporating the V8 fix.
- Google restricts access to bug details and exploit specifics (Chromium issue 506689381) until a majority of users are updated.
- NVD publishes CVE-2026-11645 (CVSS 8.8; CWE-125/CWE-787) and the vulnerability is widely reported by security media (The Hacker News, BleepingComputer, SecurityWeek, The Register, Help Net Security).
- Google confirms an exploit for CVE-2026-11645 exists in the wild, making it the fifth actively exploited Chrome zero-day of 2026.
- Google ships the fix in Chrome Stable 149.0.7827.102/.103 (Windows/macOS) and 149.0.7827.102 (Linux) as part of an update addressing 74 vulnerabilities.
Sources cited for Google Chrome V8 Out-of-Bounds Read/Write Zero-Day
- Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now
- Google patches Chrome zero-day exploited in the wild (CVE-2026-11645)
- Google patches fifth Chrome zero-day bug exploited in attacks this year
- Google Patches 5th Chrome Zero-Day Exploited in 2026
- Chrome's zero-day Whac-A-Mole continues with fifth exploited bug of the year
- Google Releases Patch for Chrome Vulnerability Exploited in the Wild
- NVD - CVE-2026-11645
- Chrome Releases: Stable Channel Update for Desktop
- Chromium Issue Tracker 506689381 (CVE-2026-11645)
Threats related to Google Chrome V8 Out-of-Bounds Read/Write Zero-Day
- Google Chrome V8 Zero-Day CVE-2026-11645 Out-of-Bounds Read/Write Exploited in the Wild
- MyFlaw: Cross-Platform RCE in Opera and Opera GX Browsers via the Built-in 'Opera Touch Background' Extension (My Flow Feature)
- CVE-2026-11645: Actively Exploited V8 Out-of-Bounds Memory Access Zero-Day in Google Chrome
- Google Chrome Stable 148.0.7778.178/179 — CVE-2026-9111 WebRTC Use-After-Free RCE & CVE-2026-9110 UI Inappropriate Implementation (16 CVEs Patched)
- Chrome V8 and Skia Zero-Days Under Active Exploitation (CVE-2026-3910, CVE-2026-3909)
- Google Chrome Dawn WebGPU Use-After-Free Zero-Day Under Active Exploitation (CVE-2026-5281)
Detection coverage for TL-2026-0725
As of 2026-06-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0725 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.