CVE-2026-11645: Google Chrome V8 out of bounds read and write

CVE-2026-11645 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2026-06-09

A critical vulnerability has been identified in the V8 engine used by Google Chrome and other Chromium-based browsers like Microsoft Edge and Opera. By tricking a user into visiting a specially crafted website, an attacker can execute malicious code within the browser's security sandbox. This could lead to browser crashes, unauthorized access to sensitive information within the browser session, or serve as a stepping stone for further attacks on the user's computer.

Technologies: Google Chrome, Google Chromium V8, Microsoft Edge, Opera Software Opera. Vendors: Google, Microsoft, Opera Software.

Quick answers

Is CVE-2026-11645 exploited in the wild?
Yes. CVE-2026-11645 is known to be exploited in the wild, first recorded on 9 June 2026. Treat it as urgent.
How severe is CVE-2026-11645?
Critical severity, with a CVSS score of 8.8, published 9 June 2026.
Which products and versions are affected?
Google Chrome prior to 149.0.7827.103, Prior to 149.0.7827.103.
Is there a fix for CVE-2026-11645?
A patch was published on 2026-06-09: Fixed in Chrome version 149.0.7827.103 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11645 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-11645?
Check whether you run Google Chrome, Google Chromium V8, Microsoft Edge or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds (OOB) read and write vulnerability exists in the V8 JavaScript and WebAssembly engine within Google Chromium. The flaw is triggered when the engine improperly handles memory access during the processing of JavaScript content, which can be exploited by a remote attacker via a crafted HTML page. Successful exploitation allows for arbitrary code execution (ACE) within the confines of the browser's sandbox. This vulnerability has been reported as being exploited in the wild. Users should update to Google Chrome version 149.0.7827.103 or later, or the equivalent version for other Chromium-based browsers.

Affected products

  • Google Chrome prior to 149.0.7827.103
  • Microsoft Edge
  • Opera Software Opera

Timeline

  • 2026-06-08: disclosed
  • 2026-06-09: advisory
  • 2026-06-09: patched: Fixed in Chrome version 149.0.7827.103
  • 2026-06-09: exploited: Reported as exploited in the wild at time of publication.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.