Google on June 9 shipped a Chrome stable channel update closing 74 vulnerabilities, including CVE-2026-11645, a high-severity V8 engine flaw that is already being exploited in the wild. The fix lands as the fifth actively exploited Chrome zero-day patched in 2026.
What CVE-2026-11645 Does
The bug (CVSS 8.8) is an out-of-bounds read and write in V8, Chrome's JavaScript and WebAssembly engine. Per NIST's vulnerability description, a remote attacker can execute arbitrary code inside Chrome's sandbox by serving a crafted HTML page to a user running Chrome below 149.0.7827.103. While the sandbox limits direct host impact, paired exploits routinely chain V8 RCE with sandbox escapes to land payloads. Successful exploitation can also bypass protections such as ASLR, making code execution via another weakness easier.
Who Found It
An anonymous researcher operating as "303f06e3" disclosed the issue to Google on April 27 and earned a $55,000 bounty. Google confirmed an exploit "exists in the wild" but, as is customary, withheld attribution and technical specifics until patches are broadly applied. This is the fifth Chrome zero-day Google has patched in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910 and CVE-2026-5281 — a pace that keeps V8 firmly at the top of browser attackers' target lists.
What To Patch And When
Users should update Chrome to 149.0.7827.102 or .103 for Windows and macOS and 149.0.7827.102 for Linux via More → Help → About Google Chrome, then relaunch. Chromium-based browsers — Microsoft Edge, Brave, Opera, Vivaldi and Arc — should be updated as their vendor builds ship the corresponding V8 fix. Enterprises running managed Chrome deployments should verify that auto-update is not deferred and that last-updated telemetry rolls forward on every endpoint.
The Bigger Cyber Picture
The Chrome zero-day arrives in a busy week for federal cyber defenders. CISA has been adding fresh entries to its Known Exploited Vulnerabilities catalog, including the new BOD 26-04 risk-based directive and a refreshed Cisco SD-WAN advisory. Together they reinforce the pattern: browsers and edge appliances remain the first line attackers reach for, and patch latency is the variable defenders can still control.
Reporting based on coverage from Google, BleepingComputer, The Hacker News and NIST NVD.