# Google Chrome V8 Out-of-Bounds Read/Write Zero-Day CVE-2026-11645 Exploited in the Wild

> CVE-2026-11645 is a high-severity out-of-bounds read/write vulnerability in the V8 JavaScript/WebAssembly engine of Google Chrome, actively exploited as a zero-day. A remote attacker can achieve arbitrary code execution inside the renderer sandbox via a crafted HTML page. It is the fifth actively exploited Chrome zero-day of 2026 and affects Chrome prior to 149.0.7827.103 and all Chromium-based browsers.

- **Published:** 2026-06-09T00:00:00Z
- **Last reviewed:** 2026-06-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0725
- **ID:** TL-2026-0725
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-11645

## Description

CVE-2026-11645 is an out-of-bounds (OOB) read and write memory-corruption vulnerability in V8, the JavaScript and WebAssembly engine that powers Google Chrome and all Chromium-derived browsers. Google confirmed on June 9, 2026 that an exploit for the flaw exists in the wild, making it the fifth actively exploited Chrome zero-day fixed in 2026. The NVD records the flaw under CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write) with a CVSS 3.1 base score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

Exploitation requires only that a victim visit an attacker-controlled or compromised web page. A maliciously crafted HTML/JavaScript payload triggers the OOB condition in V8 — typically by corrupting the bounds metadata of a JavaScript object such as a TypedArray/ArrayBuffer, or by abusing a JIT/type-confusion primitive in TurboFan/Maglev — yielding an attacker-controlled relative or absolute read/write primitive. The OOB read leaks adjacent heap memory (enabling an ASLR/heap-layout bypass and information disclosure), while the OOB write enables heap corruption that is escalated to arbitrary code execution inside the renderer process sandbox. Because the renderer remains sandboxed, real-world weaponization of a V8 RCE is generally chained with a separate sandbox-escape vulnerability to obtain code execution with full user privileges on the host.

Google's Threat Analysis Group (TAG) has historically identified Chrome zero-days used by commercial spyware vendors and state-aligned operators, but Google has not publicly attributed CVE-2026-11645 or the other four 2026 Chrome zero-days to any specific APT or spyware campaign, and withheld bug details and the exploit's technical specifics until a majority of users are patched. The vulnerability was reported on April 27, 2026 by an anonymous external researcher tracked as '303f06e3', who received a $55,000 bug bounty. The fix shipped in Chrome Stable 149.0.7827.102/.103 for Windows and macOS and 149.0.7827.102 for Linux as part of a broader update addressing 74 total vulnerabilities. CVE-2026-11645 follows CVE-2026-2441 (CSSFontFeatureValuesMap iterator invalidation, February), CVE-2026-3909 (OOB write in the Skia graphics library, March), CVE-2026-3910 (inappropriate implementation in V8, March), and CVE-2026-5281 (use-after-free in the Dawn/WebGPU component, April). Coverage notes the 2026 surge in discovered Chrome bugs is likely driven in part by AI-assisted vulnerability research.

## MITRE ATT&CK

- T1587 Develop Capabilities
- T1583 Acquire Infrastructure
- T1592 Gather Victim Host Information
- T1189 Drive-by Compromise
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1027 Obfuscated Files or Information
- T1082 System Information Discovery
- T1518 Software Discovery
- T1539 Steal Web Session Cookie
- T1185 Browser Session Hijacking
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel

## Sources

- [Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now](https://thehackernews.com/2026/06/chrome-v8-zero-day-cve-2026-11645.html)
- [Google patches Chrome zero-day exploited in the wild (CVE-2026-11645)](https://www.helpnetsecurity.com/2026/06/09/google-chrome-zero-day-cve-2026-11645/)
- [Google patches fifth Chrome zero-day bug exploited in attacks this year](https://www.bleepingcomputer.com/news/security/google-patches-fifth-chrome-zero-day-bug-exploited-in-attacks-this-year/)
- [Google Patches 5th Chrome Zero-Day Exploited in 2026](https://www.securityweek.com/google-patches-5th-chrome-zero-day-exploited-in-2026/)
- [Chrome's zero-day Whac-A-Mole continues with fifth exploited bug of the year](https://www.theregister.com/security/2026/06/09/chromes-zero-day-whac-a-mole-continues-with-fifth-exploited-bug-of-the-year/5252689)
- [Google Releases Patch for Chrome Vulnerability Exploited in the Wild](https://www.infosecurity-magazine.com/news/google-patch-chrome-vulnerability/)
- [NVD - CVE-2026-11645](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-11645)
- [Chrome Releases: Stable Channel Update for Desktop](https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html)
- [Chromium Issue Tracker 506689381 (CVE-2026-11645)](https://issues.chromium.org/issues/506689381)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0725