Google Patches Fifth Chrome Zero-Day of 2026: Active Exploit in V8 Engine

Google released an emergency Chrome update on June 9, 2026, fixing the vulnerability CVE-2026-11645, an out-of-bounds read/write bug in the V8 JavaScript engine already exploited in real-world attacks. It is the fifth zero-day patched in the browser in 2026, a pace that confirms the V8 engine as a privileged target for offensive actors. CISA has added the bug to its Known Exploited Vulnerabilities catalog with a deadline of June 23 for U.S. federal agencies.

The Bug in the V8 Engine: How the Attack Works

The vulnerability resides in the JavaScript parsing of the V8 engine, the component that executes JS code in web pages. According to the NVD record, a remote attacker can trigger heap corruption via a specially crafted HTML page, achieving arbitrary code execution inside the browser sandbox. BleepingComputer adds that the same mechanism can be used to bypass protections such as ASLR (Address Space Layout Randomization), amplifying the potential attack surface.

The attack vector is ordinary web browsing: the user requires no special privileges or manual installations. The interaction requirement — the UI:R parameter in the CVSS vector — indicates a click or link visit is needed, but no credentials or machine access. This configuration makes the bug particularly adaptable to phishing campaigns or compromised sites.

The NVD record does not report the calculated numerical CVSS score, providing only the full vector. Severity is classified as High by Google in its own Chromium assessment. The relevant technical detail is the combination of C:H/I:H/A:H impact — confidentiality, integrity, and availability all at the highest level — indicating a potentially catastrophic exploit if combined with other vulnerabilities for sandbox escape.

The 2026 Series: A Systematic Pattern in the V8 Engine

CVE-2026-11645 is not an isolated incident. Per BleepingComputer, it is the fifth Chrome zero-day patched in 2026 following CVE-2026-2441 (February), CVE-2026-3909 and CVE-2026-3910 (March), and CVE-2026-5281 (April). The report compares this rhythm with the eight zero-days of 2025, highlighting an intensification of attacks against Chrome's JavaScript engine.

The Bitdefender context source, while referring to a distinct event (CVE-2026-87491 in September), confirms the recurring pattern: that vulnerability also struck the V8 engine and was exploited in-the-wild. This convergence across separate events suggests offensive actors have identified V8's JavaScript parsing as a structural attack vector, rather than exploiting accidental configurations or sporadic bugs.

The four previous zero-days in 2026 share the same risk profile as CVE-2026-11645: remote access, low attack complexity, minimal user interaction. The fact that all were patched with out-of-cycle releases — emergency updates that interrupt the standard stable release cadence — indicates Google assesses these vulnerabilities as active threats that cannot wait for the regular channel.

The Timeline: Two Weeks Between Report and Patch

An anonymous researcher reported the bug roughly two weeks before the fix release, according to BleepingComputer. This window is consistent with an accelerated verification and development process, but also with the possibility that the exploit was already known or circulating before the report. Google has not disclosed the nature of the observed attacks, nor specific targets, victims, or delivery vectors.

"Google is aware that an exploit for CVE-2026-11645 exists in the wild"
— Google security advisory (cited by BleepingComputer)

The official quote, reported by BleepingComputer, is the only available confirmation of the exploitation status. Google adds a second relevant statement: technical details of the bug will remain restricted "until a majority of users are updated with a fix," and restrictions will persist even if the bug affects third-party libraries not yet patched. This controlled disclosure policy slows independent analysis but aims to contain exploit replication.

What to Do Now

• Update Chrome to version 149.0.7827.102 (Windows/Linux) or 149.0.7827.103 (Mac) via Settings > About Chrome, verifying the browser completes the download and prompts for a restart
• Enable automatic updates if disabled in enterprise environments, given Google has not published sufficient technical details for effective alternative mitigations
• Verify the installed version on managed systems using software inventory tools, considering Chrome is often installed with user privileges and may not be tracked by traditional patch management systems
• Meet the CISA deadline of June 23, 2026 for organizations subject to the KEV catalog, documenting the completed update or applying formal exceptions provided under the federal regime

The Limit of Reactive Patching Against Structural Targets

Five zero-days in five months in the same component raise a question that goes beyond the chronicle of a single patch. The V8 engine is designed to execute untrusted code — JavaScript from arbitrary servers — with competitive performance: this tension between speed and isolation is intrinsic to the modern browser's function. That 2026 shows a higher rate than 2025 may reflect greater attacker attention, improved detection by Google, or both.

The objective limitation is that the dossier does not document the nature of the in-the-wild attacks: targeted spyware campaigns, opportunistic malware distribution, or both. Without this information, any assessment of specific risk by sector or user profile remains speculative. What is documented is sufficient for a risk assessment: the vulnerability is exploitable via the web, requires no authentication, and an exploit already exists.

The institutional response — inclusion in the CISA KEV with a 14-day deadline — signals authorities consider the bug an immediate operational risk, not a theoretical one. For non-federal users, the deadline is not binding but the calendar is indicative: two weeks is the maximum reasonable window for an update that takes minutes.

Frequently Asked Questions

Is Chrome mobile affected?

Sources do not mention mobile versions. Chrome for Android uses V8, but the dossier does not specify whether the June 9 update extends the fix to that platform. Chrome for iOS uses WebKit, not V8, and is therefore not affected by the same vulnerability chain.

Why is the numerical CVSS score not visible?

The NVD record for CVE-2026-11645 provides the full CVSS 3.1 vector but not the calculated score. This occurs when the NVD has completed vector analysis but not the final numerical conversion, or when calculation is deferred. The vector itself — with remote attack, interaction requirement, and high impact on confidentiality, integrity, and availability — provides sufficient indication for prioritization.

Which previous versions are vulnerable?

The NVD record indicates "Google Chrome prior to 149.0.7827.103" as the vulnerable surface. The platform-specific patched versions are those cited in the key takeaways: any earlier build on Windows, Mac, or Linux is to be considered exposed unless subsequently updated.

Information has been verified against cited sources and updated at time of publication.

Sources

• https://www.bleepingcomputer.com/news/security/google-patches-fifth-chrome-zero-day-bug-exploited-in-attacks-this-year/
• https://www.bitdefender.com/en-us/blog/hotforsecurity/google-patches-chrome-zero-day-exploited-hackers
• https://nvd.nist.gov/vuln/detail/CVE-2026-11645
• https://www.bleepingcomputer.com/
• https://www.bleepingcomputer.com/tutorials/
• https://deals.bleepingcomputer.com/