What CVE-2026-11645 Is and Why It Matters
CVE-2026-11645 is a high-severity Chrome V8 zero-day browser vulnerability exploit that allows out-of-bounds memory access and can let attackers run arbitrary code inside the browser’s sandbox through a malicious web page. This flaw sits in V8, Chrome’s JavaScript and WebAssembly engine, and carries a CVSS score of 8.8, putting it firmly in the high-risk category. In practice, visiting a crafted HTML page could allow a remote attacker to gain a foothold within your browser session, potentially leading to further compromise. Google has confirmed that “an exploit for CVE-2026-11645 exists in the wild,” which means attackers are already using it rather than waiting for proof-of-concept code. Because the bug affects a core engine shared across Chromium-based browsers, the exposure is broad and demands immediate attention from users and administrators.
Inside the Chrome Security Update and the V8 Flaw
In the latest Chrome security update, Google fixed 74 vulnerabilities, with CVE-2026-11645 among the most critical issues addressed. The weakness is an out-of-bounds read and write in V8 that allows arbitrary code execution inside the sandbox via a crafted HTML page, according to the National Vulnerability Database. While the sandbox limits direct access to the underlying operating system, attackers can still use such code execution as a staging point for further attacks or data theft within the browser context. The flaw was reported to Google on April 27, 2026, by a researcher known as “303f06e3,” who received a bug bounty of USD 55,000 (approx. RM253,000) for responsible disclosure. Google is withholding detailed technical information until most users have installed the CVE-2026-11645 patch, which is standard practice for actively exploited vulnerabilities.
A Growing Pattern of Chrome Zero-Days
CVE-2026-11645 is not an isolated incident; it is the fifth actively exploited Chrome zero-day that Google has fixed this year. Earlier zero-days include CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281, underscoring sustained targeting of Chrome by attackers who focus on browser vulnerability exploits. This pattern shows that browsers, as always-on gateways to the internet, remain high-value targets for threat actors. Each new exploit provides another path to run code, steal data, or chain with other flaws. The fact that CVE-2026-11645 resides in the V8 engine also matters because many Chromium-based browsers reuse this component, multiplying the potential impact. For security teams, these repeated zero-days signal that keeping browsers fully patched must be treated as a continuous, high-priority operational task, not a periodic maintenance activity.
CISA’s KEV Catalog Warning and Risk Signal
The urgency around CVE-2026-11645 increased further when the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to the Known Exploited Vulnerabilities (KEV) catalog. This move places the Chrome V8 zero-day alongside other actively abused flaws, including issues in Cisco Catalyst SD-WAN Manager and Arista EOS. CISA’s KEV inclusion signals that the vulnerability presents a significant, observed threat and that timely patching is not optional for organizations that follow its guidance. Federal Civilian Executive Branch agencies, for example, have been ordered to address the listed vulnerabilities by June 23, 2026. While CISA’s directive targets specific entities, the message is clear for everyone: if a flaw appears in KEV, assume adversaries will keep exploiting it at scale until widespread patching closes the window of opportunity.
How to Apply the CVE-2026-11645 Patch Now
To close the CVE-2026-11645 attack vector, you must install the latest Chrome security update without delay. Google has released the fix in Chrome versions 149.0.7827.102 and 149.0.7827.103 for Windows and macOS, and version 149.0.7827.102 for Linux. On desktop, open Chrome, select More (the three dots) > Help > About Google Chrome, and let the browser download updates; then click Relaunch to apply them. This ensures the CVE-2026-11645 patch is active. Because the V8 engine powers other Chromium-based browsers, users of Microsoft Edge, Brave, Opera, and Vivaldi should likewise check for and apply their latest browser security updates as they become available. For enterprises, consider enforcing minimum browser versions through management tools and monitoring for outdated builds on endpoints.
