# Google Chrome V8 Zero-Day CVE-2026-11645 Out-of-Bounds Read/Write Exploited in the Wild

> CVE-2026-11645 is an actively exploited out-of-bounds read/write vulnerability in Chrome's V8 JavaScript/WebAssembly engine (CVSS 8.8). A crafted HTML page can corrupt renderer memory, leak data, and—when chained with a sandbox escape—achieve remote code execution. Google confirmed an exploit exists in the wild and shipped fixes in Chrome 149.0.7827.102/.103.

- **Published:** 2026-06-09T00:00:00Z
- **Last reviewed:** 2026-06-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0735
- **ID:** TL-2026-0735
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** ZERO_DAY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-11645

## Description

On June 9, 2026, Google released a Chrome Stable Channel update fixing CVE-2026-11645, an out-of-bounds read and write condition in V8, the JavaScript and WebAssembly engine that processes web content in Chrome's renderer process. Google's advisory states it 'is aware that an exploit for CVE-2026-11645 exists in the wild,' making this the fifth actively exploited Chrome zero-day patched in 2026 (following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281).

The vulnerability resides in V8's memory handling. By luring a victim to a malicious or compromised web page, an attacker can trigger out-of-bounds memory access from attacker-controlled JavaScript/WebAssembly. The primitive enables an adversary to corrupt memory, leak sensitive process data, and—when combined with additional bugs—escalate to arbitrary code execution within the renderer sandbox. Full host compromise requires chaining the V8 bug with a separate sandbox-escape primitive, a pattern consistent with multi-stage browser exploit chains historically attributed to commercial surveillance vendors and state-aligned operators.

Reporting indicates exploitation has been limited to targeted operations rather than broad, indiscriminate campaigns: The Register noted 'there is no indication that the latest flaw has been used in broad, indiscriminate attacks.' Google withheld technical specifics of the exploit and any indicators of compromise to protect users until a majority have updated, a standard practice for in-the-wild browser zero-days. As a result, no public network IOCs or C2 infrastructure have been disclosed; detection and hunting must rely on version posture, renderer-crash anomalies, and behavioral exploitation indicators.

The flaw was reported on April 27, 2026 by an external researcher using the handle '303f06e3' and earned a $55,000 bug bounty. It was fixed in Chrome 149.0.7827.102/.103 (Windows and macOS) and 149.0.7827.102 (Linux). The same release shipped 74 total security fixes, including 17 Critical and 57 High-severity issues across subsystems such as WebRTC, PDF, Extensions, and GPU. Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi, Electron applications) are also affected and require downstream updates.

## MITRE ATT&CK

- T1588 Obtain Capabilities
- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1592 Gather Victim Host Information
- T1598 Phishing for Information
- T1189 Drive-by Compromise
- T1566 Phishing
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1211 Exploitation for Stealth
- T1068 Exploitation for Privilege Escalation
- T1082 System Information Discovery
- T1518 Software Discovery
- T1185 Browser Session Hijacking
- T1539 Steal Web Session Cookie
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [Google Chrome 0-Day Vulnerability Exploited in the Wild, Update Now](https://cybersecuritynews.com/google-chrome-0-day-vulnerability-exploited-in-the-wild-update-now/)
- [Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now](https://thehackernews.com/2026/06/chrome-v8-zero-day-cve-2026-11645.html)
- [Google patches Chrome zero-day exploited in the wild (CVE-2026-11645)](https://www.helpnetsecurity.com/2026/06/09/google-chrome-zero-day-cve-2026-11645/)
- [Google patches fifth Chrome zero-day bug exploited in attacks this year](https://www.bleepingcomputer.com/news/security/google-patches-fifth-chrome-zero-day-bug-exploited-in-attacks-this-year/)
- [Google fixes the fifth actively exploited Chrome zero-day of 2026](https://securityaffairs.com/193371/hacking/google-fixes-fifth-actively-exploited-chrome-zero-day-of-2026.html)
- [Chrome's zero-day Whac-A-Mole continues with fifth exploited bug of the year](https://www.theregister.com/security/2026/06/09/chromes-zero-day-whac-a-mole-continues-with-fifth-exploited-bug-of-the-year/5252689)
- [CVE-2026-11645: Exploited Chrome V8 Bug Enables In-Browser Code Execution](https://socradar.io/blog/cve-2026-11645-chrome-v8-bug/)
- [Google Releases Patch for Chrome Vulnerability Exploited in the Wild](https://www.infosecurity-magazine.com/news/google-patch-chrome-vulnerability/)
- [NVD - CVE-2026-11645](https://nvd.nist.gov/vuln/detail/CVE-2026-11645)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0735