CVE-2026-11645: Actively Exploited V8 Out-of-Bounds Memory Access Zero-Day in Google Chrome

CVE-2026-11645 (TL-2026-0740), also tracked as Chrome V8 OOB Zero-Day, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-06-09. It has no confirmed attribution, affects Google Chrome (Windows), references 1 CVE (CVE-2026-11645), maps to 20 MITRE ATT&CK techniques (T1027, T1041, T1059.007), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-0740

Threat ID
TL-2026-0740
Also known as
Chrome V8 OOB Zero-Day, Fifth Chrome Zero-Day of 2026
Severity
HIGH
CVSS
8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-06-09
Last reviewed
2026-06-09
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
technology, government, financial, media, general
Target regions
Global
Detection rules
9
Indicators of compromise
16

CVE-2026-11645 is a high-severity (CVSS 8.8) out-of-bounds read/write flaw in Chrome's V8 JavaScript and WebAssembly engine that allows a remote attacker to execute arbitrary code inside the renderer sandbox via a crafted HTML page. Google confirms an exploit exists in the wild; it is the fifth actively exploited Chrome zero-day of 2026, fixed in Stable Channel 149.0.7827.102/.103.

How CVE-2026-11645 works

On June 9, 2026 Google shipped an emergency Stable Channel update for the Chrome desktop browser to remediate CVE-2026-11645, an out-of-bounds memory access vulnerability in the V8 JavaScript and WebAssembly engine. The vulnerability is described as 'out-of-bounds read and write in V8 in Google Chrome prior to 149.0.7827.103,' allowing a remote attacker to execute arbitrary code inside the renderer sandbox through a crafted HTML page. Google has acknowledged that 'an exploit for CVE-2026-11645 exists in the wild,' making this the fifth Chrome zero-day exploited in attacks during 2026 — following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281 — and surpassing the pace set in 2025, when eight Chrome zero-days were patched across the full year.

The defect lives in V8's TurboFan optimizing JIT compiler. According to public analysis, the root cause is in TurboFan's range-analysis (typer) phase, which tracks the possible minimum and maximum values of loop induction variables and array indices. A logic flaw in the range tracker incorrectly computes the maximum possible value of a variable that is modified inside a loop or through specific bitwise operations, leading TurboFan to conclude that the index cannot exceed an array's bounds when in fact it can. Because the optimizer believes the bounds check is provably redundant, it elides the check, and at runtime the compiled native code reads and writes memory locations outside the allocated backing store of the typed array — yielding a powerful out-of-bounds primitive directly from attacker-controlled JavaScript.

V8 memory-corruption bugs of this class are repeatedly weaponized because they grant an attacker an initial foothold inside the renderer process: an OOB read/write primitive can be groomed into an arbitrary read/write within the V8 heap, used to leak pointers and defeat ASLR, fake object metadata, and ultimately achieve code execution in the renderer sandbox. Such renderer-level RCE is rarely the end of an exploit chain — threat actors typically pair a V8 bug like this with a separate sandbox-escape or privilege-escalation vulnerability to break out of the browser sandbox and execute on the host. Delivery for in-the-wild V8 zero-days of this type is consistent with drive-by-compromise: a victim is lured (via phishing link, watering-hole site, or malvertising) to an attacker-controlled web page whose JavaScript silently triggers the bug with no user interaction beyond visiting the page.

The flaw was reported on April 27, 2026 by an external researcher using the handle '303f06e3', who received a $55,000 bug-bounty award. Per Google's standard practice for actively exploited bugs, deeper technical specifics and any indicators of compromise have been withheld until a majority of users have updated, in order to slow further exploitation. As of disclosure there are no Google-published network IOCs (IPs, domains, or hashes); detection therefore centers on enforcing the patched browser version and on behavioral telemetry for renderer crashes and anomalous V8/JIT activity. The fix is delivered in Chrome Stable 149.0.7827.102/.103 for Windows and macOS and 149.0.7827.102 for Linux, rolling out over the days and weeks following release. Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi) share the V8 engine and should be updated as their respective vendors ship the corresponding fix.

MITRE ATT&CK techniques used in TL-2026-0740

Defense Evasion

T1027 Obfuscated Files or Information; T1211 Exploitation for Stealth; T1497 Virtualization/Sandbox Evasion

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.007 JavaScript; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071.001 Web Protocols; T1105 Ingress Tool Transfer

Collection

T1185 Browser Session Hijacking

Initial Access

T1189 Drive-by Compromise; T1566.002 Spearphishing Link

Discovery

T1518.001 Security Software Discovery

Credential Access

T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers

Resource Development

T1583.001 Domains; T1588.005 Exploits; T1608.004 Drive-by Target

Reconnaissance

T1592 Gather Victim Host Information; T1592.004 Client Configurations

Affected products and versions in CVE-2026-11645

  • Google — Chrome (Windows)
    Vulnerable versions: < 149.0.7827.102
    Fixed in: 149.0.7827.102; 149.0.7827.103
  • Google — Chrome (macOS)
    Vulnerable versions: < 149.0.7827.102
    Fixed in: 149.0.7827.102; 149.0.7827.103
  • Google — Chrome (Linux)
    Vulnerable versions: < 149.0.7827.102
    Fixed in: 149.0.7827.102
  • Various — Chromium-based browsers (Edge, Brave, Opera, Vivaldi)
    Vulnerable versions: Builds using V8 prior to the 149.0.7827.102 fix
    Fixed in: Vendor builds incorporating the patched V8

Remediation for CVE-2026-11645

Patches

  • Chrome Stable Channel 149.0.7827.103 (Windows/macOS)
  • Chrome Stable Channel 149.0.7827.102 (Windows/macOS/Linux)

Immediate actions

  • Update Google Chrome to Stable 149.0.7827.102/.103 (Windows/macOS) or 149.0.7827.102 (Linux) immediately; relaunch the browser to apply the update.
  • Verify the running version enterprise-wide via chrome://settings/help and management tooling; flag any host on a build prior to 149.0.7827.102.
  • Prioritize patching high-risk user groups (executives, finance, IT admins, externally exposed staff) first.

Workarounds

  • Until patched, restrict browsing to trusted sites and consider site isolation / reduced JavaScript exposure for high-risk users.
  • Use enterprise web filtering to block known-malicious and newly-registered domains that could host drive-by exploit pages.

Longer-term hardening

  • Enforce Chrome auto-update and minimum-version policy via Google Admin console / enterprise group policy (RelaunchNotification, TargetVersionPrefix).
  • Deploy EDR with behavioral detection for renderer-process crashes and child-process spawning from browser processes.
  • Apply the same update discipline to all Chromium-based browsers (Edge, Brave, Opera, Vivaldi) that share the V8 engine.

CVEs associated with CVE-2026-11645

CVE-2026-11645

Weaknesses (CWE) in CVE-2026-11645

CWE-787, CWE-125, CWE-119, CWE-1285

Timeline of CVE-2026-11645

  • External researcher using the handle '303f06e3' reports the out-of-bounds memory access flaw in V8 to Google; the report is later awarded a $55,000 bug bounty.
  • Google stages the emergency Stable Channel fix (149.0.7827.102/.103) addressing CVE-2026-11645 ahead of public disclosure.
  • Because the flaw is in the shared V8 engine, Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi) are advised to apply the corresponding vendor update as each ships the patched V8.
  • Google notes the fixed Chrome Stable build 149.0.7827.102/.103 rolls out to Windows, macOS, and Linux users over the days and weeks following release, meaning not all users are protected immediately on disclosure day.
  • Disclosure noted in the context of the prior 2026 Chrome zero-days CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281, and the eight Chrome zero-days patched during 2025.
  • Vendors and trackers (The Register, The Hacker News, SOCRadar, SOC Prime, CyberInsider, BleepingComputer) publish analyses; Google withholds deep technical details and IOCs to slow further exploitation.
  • Google confirms an exploit for CVE-2026-11645 exists in the wild, making it the fifth actively exploited Chrome zero-day of 2026.
  • Google publicly discloses CVE-2026-11645 and ships the Stable Channel update for Windows, macOS, and Linux; assigns CVSS 8.8 (High).

Sources cited for CVE-2026-11645

Threats related to CVE-2026-11645

Detection coverage for TL-2026-0740

As of 2026-06-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0740 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats