Google Chrome V8 Zero-Day CVE-2026-11645 Out-of-Bounds Read/Write Exploited in the Wild

Google Chrome V8 Zero-Day CVE-2026-11645 Out-of-Bounds (TL-2026-0735), also tracked as Chrome V8 OOB Zero-Day, is a critical-severity zero-day vulnerability scored CVSS 8.8, first published 2026-06-09. It has no confirmed attribution, affects Google Chrome (Stable Channel), references 1 CVE (CVE-2026-11645), maps to 18 MITRE ATT&CK techniques (T1041, T1059, T1068), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-0735

Threat ID
TL-2026-0735
Also known as
Chrome V8 OOB Zero-Day, Fifth Chrome Zero-Day of 2026
Severity
CRITICAL
CVSS
8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
ZERO_DAY
First published
2026-06-09
Last reviewed
2026-06-09
Attribution confidence
NONE
Motivation
ESPIONAGE
Target sectors
government, media, civil-society, technology, telecommunications
Target regions
Global
Detection rules
9
Indicators of compromise
18

CVE-2026-11645 is an actively exploited out-of-bounds read/write vulnerability in Chrome's V8 JavaScript/WebAssembly engine (CVSS 8.8). A crafted HTML page can corrupt renderer memory, leak data, and—when chained with a sandbox escape—achieve remote code execution. Google confirmed an exploit exists in the wild and shipped fixes in Chrome 149.0.7827.102/.103.

How Google Chrome V8 Zero-Day CVE-2026-11645 Out-of-Bounds works

On June 9, 2026, Google released a Chrome Stable Channel update fixing CVE-2026-11645, an out-of-bounds read and write condition in V8, the JavaScript and WebAssembly engine that processes web content in Chrome's renderer process. Google's advisory states it 'is aware that an exploit for CVE-2026-11645 exists in the wild,' making this the fifth actively exploited Chrome zero-day patched in 2026 (following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281).

The vulnerability resides in V8's memory handling. By luring a victim to a malicious or compromised web page, an attacker can trigger out-of-bounds memory access from attacker-controlled JavaScript/WebAssembly. The primitive enables an adversary to corrupt memory, leak sensitive process data, and—when combined with additional bugs—escalate to arbitrary code execution within the renderer sandbox. Full host compromise requires chaining the V8 bug with a separate sandbox-escape primitive, a pattern consistent with multi-stage browser exploit chains historically attributed to commercial surveillance vendors and state-aligned operators.

Reporting indicates exploitation has been limited to targeted operations rather than broad, indiscriminate campaigns: The Register noted 'there is no indication that the latest flaw has been used in broad, indiscriminate attacks.' Google withheld technical specifics of the exploit and any indicators of compromise to protect users until a majority have updated, a standard practice for in-the-wild browser zero-days. As a result, no public network IOCs or C2 infrastructure have been disclosed; detection and hunting must rely on version posture, renderer-crash anomalies, and behavioral exploitation indicators.

The flaw was reported on April 27, 2026 by an external researcher using the handle '303f06e3' and earned a $55,000 bug bounty. It was fixed in Chrome 149.0.7827.102/.103 (Windows and macOS) and 149.0.7827.102 (Linux). The same release shipped 74 total security fixes, including 17 Critical and 57 High-severity issues across subsystems such as WebRTC, PDF, Extensions, and GPU. Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi, Electron applications) are also affected and require downstream updates.

MITRE ATT&CK techniques used in TL-2026-0735

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery; T1518 Software Discovery

Collection

T1185 Browser Session Hijacking

Initial Access

T1189 Drive-by Compromise; T1566 Phishing

Defense Evasion

T1211 Exploitation for Stealth

Credential Access

T1539 Steal Web Session Cookie

Resource Development

T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1588 Obtain Capabilities

Reconnaissance

T1592 Gather Victim Host Information; T1598 Phishing for Information

Affected products and versions in Google Chrome V8 Zero-Day CVE-2026-11645 Out-of-Bounds

  • Google — Chrome (Stable Channel)
    Vulnerable versions: < 149.0.7827.102 (Linux); < 149.0.7827.102/.103 (Windows/macOS)
    Fixed in: 149.0.7827.102 (Linux); 149.0.7827.102/.103 (Windows/macOS)
  • Multiple — Chromium-based browsers (Edge, Brave, Opera, Vivaldi)
    Vulnerable versions: builds on Chromium prior to 149.0.7827.102
    Fixed in: vendor builds incorporating the V8 fix
  • OpenJS / Multiple — Electron / CEF embedded applications
    Vulnerable versions: bundling vulnerable Chromium/V8
    Fixed in: rebuilt with patched Chromium/V8

Remediation for Google Chrome V8 Zero-Day CVE-2026-11645 Out-of-Bounds

Patches

  • Google Chrome 149.0.7827.103 (Windows/macOS)
  • Google Chrome 149.0.7827.102 (Linux)
  • Corresponding Microsoft Edge / Chromium-derived browser security updates

Immediate actions

  • Update Google Chrome to 149.0.7827.102/.103 (Windows/macOS) or 149.0.7827.102 (Linux) via Help > About Google Chrome, then relaunch to apply.
  • Force-restart the browser after update; the patch only takes effect on relaunch.
  • Push the update enterprise-wide via Chrome Browser Cloud Management / group policy rather than relying on user-initiated updates.

Workarounds

  • Restrict browsing on sensitive/high-risk endpoints until patched.
  • Use network/DNS filtering to reduce exposure to attacker-controlled landing pages.

Longer-term hardening

  • Deploy EDR with browser-process behavioral telemetry to flag renderer crashes and anomalous child-process spawns from chrome.exe.
  • Enable and enforce automatic browser updates across the fleet; monitor version compliance.
  • Apply Chromium update discipline to all derivative browsers (Edge, Brave, Opera, Vivaldi) and embedded Electron/CEF applications.
  • Consider site isolation hardening and disabling unnecessary high-risk web features (WebGPU/WASM) for high-value targets.

CVEs associated with Google Chrome V8 Zero-Day CVE-2026-11645 Out-of-Bounds

CVE-2026-11645

Weaknesses (CWE) in Google Chrome V8 Zero-Day CVE-2026-11645 Out-of-Bounds

CWE-125, CWE-787, CWE-119, CWE-122

Timeline of Google Chrome V8 Zero-Day CVE-2026-11645 Out-of-Bounds

  • Google later awards a $55,000 bug bounty for the responsibly disclosed flaw.
  • External researcher using the handle '303f06e3' reports the V8 out-of-bounds read/write vulnerability to Google.
  • Active in-the-wild exploitation of CVE-2026-11645 detected; reporting indicates use limited to targeted operations rather than broad campaigns (approximate, pre-disclosure window).
  • Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi) and embedded Electron/CEF applications inherit the vulnerable V8 code and require separate downstream vendor updates incorporating the fix.
  • Identified as the fifth actively exploited Chrome zero-day of 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281.
  • Google restricts technical exploit details and IOCs until a majority of users have updated, standard practice for in-the-wild browser zero-days.
  • Public disclosure across security press (The Hacker News, BleepingComputer, Help Net Security, SecurityAffairs, The Register); part of a 74-fix release (17 Critical, 57 High).
  • Google ships Chrome Stable Channel 149.0.7827.102/.103 (Windows/macOS) and 149.0.7827.102 (Linux), assigning CVE-2026-11645 and confirming an exploit exists in the wild.
  • Google's Stable Channel update rolls out to the full user base over the coming days/weeks (staged rollout), leaving a window of exposure for un-updated endpoints and elevating n-day risk as exploit details surface.

Sources cited for Google Chrome V8 Zero-Day CVE-2026-11645 Out-of-Bounds

Threats related to Google Chrome V8 Zero-Day CVE-2026-11645 Out-of-Bounds

Detection coverage for TL-2026-0735

As of 2026-06-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0735 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats