Chrome V8 CVE-2026-11645: Exploited Out-of-Bounds Zero-Day

What to do

1. Open chrome://settings/help (or edge://settings/help), relaunch if an update is pending, and confirm the version is 149.0.7827.102 or later; current Chrome is 156.
2. In managed fleets, report browser versions and flag anything below Chrome 149.0.7827.102 or Edge 149.0.4022.62.
3. Move machines off Chrome Extended Stable 148 unless Google or your support channel confirms that build carries the fix.
4. Remove policies that pin Chrome or Edge to an old version or defer updates indefinitely, and rebuild kiosk, VDI and golden images.
5. Ask Electron app vendors which Chromium their build carries; treat anything below Chromium 149.0.7827.102 as unpatched until they confirm a backport.

How to check if you are affected or compromised

• Query endpoint inventory for Chrome, Edge, Brave or Chromium builds below the fixed versions at any point since early June 2026, and list the users of those machines.
• Google has published no indicators for this exploit; for high-risk users who ran unpatched builds in May or June 2026, review EDR for browser processes spawning unexpected executables and for new persistence around that time.

What happened#

On June 8, 2026, Google released Chrome 149.0.7827.102/.103 for Windows and Mac and 149.0.7827.102 for Linux, with 74 security fixes. One of them, CVE-2026-11645, is an out-of-bounds memory access in V8, Chrome's JavaScript and WebAssembly engine. The release notes credit a reporter known as "303f06e3," who reported it on April 27 and received a $55,000 bounty. The same notes state: "Google is aware that an exploit for CVE-2026-11645 exists in the wild." Google has not said when it learned of the exploitation, who was behind it, or who was targeted.

The CVE record describes an out-of-bounds read and write that lets a crafted HTML page "execute arbitrary code inside a sandbox." That means code runs in the renderer, and taking over the machine would normally need a second bug to escape the sandbox. NVD shows only CISA's ADP score, CVSS 3.1 8.8 (CWE-125, CWE-787) (NVD). CISA added the CVE to KEV on June 9, 2026, with a June 23 deadline. The Hacker News counted it as the fifth exploited Chrome zero-day of 2026.

Who is affected#

The CVE record lists Chrome before 149.0.7827.103. Google's fixed Linux build is 149.0.7827.102. These fixes are verified:

• Chrome for Android 149.0.7827.102, released June 8 with the same security fixes as desktop.
• Microsoft Edge 149.0.4022.62, released June 9 (Edge security notes).
• Brave 1.91.171, which moved to Chromium 149.0.7827.103 on June 9.

Electron's release notes do not name this fix. Electron 43.0.0 (June 30) ships Chromium 150.0.7871.46, which is above the affected range. Google's Extended Stable update to 148.0.7778.254 on June 8 does not list its security fixes, so this brief cannot confirm that it is covered.

Do you really need to act?#

For most people, no. Chrome, Edge and Brave auto-update, and Chrome Stable reached 156 on October 20, 2026. The machines worth finding are:

• Machines on pinned or deferred update policies.
• Kiosk and VDI images frozen before mid-June.
• Machines held on Extended Stable 148.
• Users who never relaunch.
• Electron and other embedded-Chromium apps whose vendors lag behind Chrome.

What to do now#

1. Check versions with google-chrome --version, or on Windows with (Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion. Use edge://settings/help for Edge and brave://settings/help for Brave.
2. In your endpoint inventory, flag anything below Chrome 149.0.7827.102, Edge 149.0.4022.62 or Brave 1.91.171.
3. Review chrome://policy on managed machines. Remove version pins or indefinite deferrals, and enable RelaunchNotification.
4. Move machines off Extended Stable 148 unless Google confirms that build is covered, and rebuild kiosk and VDI images.
5. On macOS, read an Electron app's version with defaults read "/Applications/App.app/Contents/Frameworks/Electron Framework.framework/Resources/Info.plist" CFBundleVersion. Ask the vendor to confirm the fix for anything older than 43.0.0.

How to tell if you were hit#

Google has published no indicators of compromise. As of Oct 23, 2026, no public report ties the exploit to a named actor or campaign. Start from inventory: which machines ran Chrome, Edge or Brave below the fixed builds in May and June 2026, and who used them? For high-risk users in that group, review EDR telemetry from that window. Look for browser processes spawning unexpected executables, and for new services, scheduled tasks or launch agents.

Timeline#

• Apr 27, 2026 — Researcher 303f06e3 reports the bug to Chrome.
• Jun 8, 2026 — Chrome 149.0.7827.102/.103 and Chrome for Android 149.0.7827.102 ship, Google confirms an in-the-wild exploit, and the CVE is published.
• Jun 9, 2026 — Edge 149.0.4022.62 and Brave 1.91.171 ship fixes, and CISA adds the CVE to KEV.
• Jun 23, 2026 — CISA's remediation deadline for federal agencies.
• Jun 30, 2026 — Electron 43.0.0 ships on Chromium 150.

Vulnerability records

• CVE-2026-11645 · KEV 2026-06-09 · Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Google Chrome Releases — Stable Channel Update for Desktop (Jun 8, 2026) chromereleases.googleblog.com
2. Google Chrome Releases — Chrome for Android Update (Jun 8, 2026) chromereleases.googleblog.com
3. CVE record — CVE-2026-11645 cve.org
4. NVD — CVE-2026-11645 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2026-11645 cisa.gov
6. Microsoft — Release notes for Microsoft Edge Security Updates learn.microsoft.com
7. Brave — Release v1.91.171 (Chromium 149.0.7827.103) github.com
8. Electron — v43.0.0 release notes github.com
9. Google Chrome Releases — Chrome 156 promoted to Stable (Oct 20, 2026) chromereleases.googleblog.com

Coverage and analysis

1. The Hacker News — Chrome V8 zero-day CVE-2026-11645 exploited in the wild thehackernews.com