# CVE-2026-11645: Actively Exploited V8 Out-of-Bounds Memory Access Zero-Day in Google Chrome

> CVE-2026-11645 is a high-severity (CVSS 8.8) out-of-bounds read/write flaw in Chrome's V8 JavaScript and WebAssembly engine that allows a remote attacker to execute arbitrary code inside the renderer sandbox via a crafted HTML page. Google confirms an exploit exists in the wild; it is the fifth actively exploited Chrome zero-day of 2026, fixed in Stable Channel 149.0.7827.102/.103.

- **Published:** 2026-06-09T00:00:00Z
- **Last reviewed:** 2026-06-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0740
- **ID:** TL-2026-0740
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-11645

## Description

On June 9, 2026 Google shipped an emergency Stable Channel update for the Chrome desktop browser to remediate CVE-2026-11645, an out-of-bounds memory access vulnerability in the V8 JavaScript and WebAssembly engine. The vulnerability is described as 'out-of-bounds read and write in V8 in Google Chrome prior to 149.0.7827.103,' allowing a remote attacker to execute arbitrary code inside the renderer sandbox through a crafted HTML page. Google has acknowledged that 'an exploit for CVE-2026-11645 exists in the wild,' making this the fifth Chrome zero-day exploited in attacks during 2026 — following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281 — and surpassing the pace set in 2025, when eight Chrome zero-days were patched across the full year.

The defect lives in V8's TurboFan optimizing JIT compiler. According to public analysis, the root cause is in TurboFan's range-analysis (typer) phase, which tracks the possible minimum and maximum values of loop induction variables and array indices. A logic flaw in the range tracker incorrectly computes the maximum possible value of a variable that is modified inside a loop or through specific bitwise operations, leading TurboFan to conclude that the index cannot exceed an array's bounds when in fact it can. Because the optimizer believes the bounds check is provably redundant, it elides the check, and at runtime the compiled native code reads and writes memory locations outside the allocated backing store of the typed array — yielding a powerful out-of-bounds primitive directly from attacker-controlled JavaScript.

V8 memory-corruption bugs of this class are repeatedly weaponized because they grant an attacker an initial foothold inside the renderer process: an OOB read/write primitive can be groomed into an arbitrary read/write within the V8 heap, used to leak pointers and defeat ASLR, fake object metadata, and ultimately achieve code execution in the renderer sandbox. Such renderer-level RCE is rarely the end of an exploit chain — threat actors typically pair a V8 bug like this with a separate sandbox-escape or privilege-escalation vulnerability to break out of the browser sandbox and execute on the host. Delivery for in-the-wild V8 zero-days of this type is consistent with drive-by-compromise: a victim is lured (via phishing link, watering-hole site, or malvertising) to an attacker-controlled web page whose JavaScript silently triggers the bug with no user interaction beyond visiting the page.

The flaw was reported on April 27, 2026 by an external researcher using the handle '303f06e3', who received a $55,000 bug-bounty award. Per Google's standard practice for actively exploited bugs, deeper technical specifics and any indicators of compromise have been withheld until a majority of users have updated, in order to slow further exploitation. As of disclosure there are no Google-published network IOCs (IPs, domains, or hashes); detection therefore centers on enforcing the patched browser version and on behavioral telemetry for renderer crashes and anomalous V8/JIT activity. The fix is delivered in Chrome Stable 149.0.7827.102/.103 for Windows and macOS and 149.0.7827.102 for Linux, rolling out over the days and weeks following release. Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi) share the V8 engine and should be updated as their respective vendors ship the corresponding fix.

## MITRE ATT&CK

- T1592 Gather Victim Host Information
- T1592.004 Client Configurations
- T1588.005 Exploits
- T1583.001 Domains
- T1608.004 Drive-by Target
- T1189 Drive-by Compromise
- T1566.002 Spearphishing Link
- T1203 Exploitation for Client Execution
- T1059.007 JavaScript
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1539 Steal Web Session Cookie
- T1555.003 Credentials from Web Browsers
- T1518.001 Security Software Discovery
- T1185 Browser Session Hijacking
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [Chrome's zero-day whac-a-mole continues with fifth exploited bug of the year](https://www.theregister.com/security/2026/06/09/chromes-zero-day-whac-a-mole-continues-with-fifth-exploited-bug-of-the-year/5252689)
- [Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now](https://thehackernews.com/2026/06/chrome-v8-zero-day-cve-2026-11645.html)
- [CVE-2026-11645: Exploited Chrome V8 Bug Enables In-Browser Code Execution](https://socradar.io/blog/cve-2026-11645-chrome-v8-bug/)
- [CVE-2026-11645: Chrome Zero-Day Vulnerability Exploited in the Wild](https://socprime.com/blog/cve-2026-11645-chrome-zero-day-vulnerability-exploited-in-the-wild/)
- [Google Chrome emergency update fixes actively exploited flaw in V8](https://cyberinsider.com/google-chrome-emergency-update-fixes-actively-exploited-flaw-in-v8/)
- [Google patches fifth Chrome zero-day bug exploited in attacks this year](https://www.bleepingcomputer.com/news/security/google-patches-fifth-chrome-zero-day-bug-exploited-in-attacks-this-year/)
- [Google Chrome 0-Day Vulnerability Exploited in the Wild — Update Now](https://cybersecuritynews.com/google-chrome-0-day-vulnerability-exploited-in-the-wild-update-now/)
- [CVE-2026-11645: Out-of-Bounds Memory Access in Google Chrome V8 Engine](https://cvereports.com/reports/CVE-2026-11645)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0740