CVE-2026-11645: Google Patches Fifth Chrome…

Google has released a critical patch for CVE-2026-11645, a zero-day vulnerability in Chrome's V8 engine. With an exploit active in the wild, CISA has set a June 23 deadline for federal agencies to secure their systems.

Source Note: Technical details in this article are based on Penligent's analysis of Chrome Releases and NVD citations, rather than a direct Google advisory. Quotes from HelpNetSecurity reflect statements from the Google advisory.

On June 8, 2026, Google released a critical patch for CVE-2026-11645, a zero-day vulnerability in Chrome's V8 JavaScript engine that is being actively exploited in real-world attacks. The flaw enables arbitrary code execution within the renderer sandbox via a malicious HTML page. For U.S. federal agencies, CISA has set June 23, 2026, as the mandatory deadline for remediation.

This threat extends beyond Chrome: any ecosystem dependent on Chromium—including Electron apps, CEF-based software, and derivative browsers—inherits this attack surface but may not follow Google’s automatic update cycle.

Key Takeaways

Google confirms an exploit for CVE-2026-11645 is active in the wild; the patch is available as of June 8, 2026, in Stable versions 149.0.7827.102/.103.
The vulnerability is an out-of-bounds read/write in the V8 engine, carrying a CVSS 8.8 HIGH rating according to NVD records enriched by CISA-ADP.
CISA added the flaw to the KEV catalog on June 9, 2026, establishing a June 23 compliance deadline for federal agencies.
The hidden dependency on Chromium in third-party applications expands the risk perimeter beyond the desktop browser.

Attack Vector: V8 as the Entry Point

According to the official NVD record for CVE-2026-11645, the vulnerability consists of an out-of-bounds read and write in Google Chrome's V8 JavaScript engine in versions prior to 149.0.7827.103. A remote attacker triggers the bug by inducing a user to load a crafted HTML page, resulting in arbitrary code execution inside the renderer sandbox.

The V8 engine is the core component that compiles and executes JavaScript in Chrome. Its attack surface is massive: every website, extension, and progressive web app interacts with V8. The combination of remote accessibility (AV:N), low attack complexity (AC:L), and the requirement for simple user interaction (UI:R) makes this a nearly universal vector for users on unpatched versions.

The "in sandbox" restriction defines the immediate scope of the attack. A compromised renderer operates within architectural boundaries that isolate the process from the operating system. The current brief does not document any sandbox escape techniques associated with this specific vulnerability.

"Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page" — NVD, CVE-2026-11645

Timeline and Impact: A $55,000 Bug

The vulnerability was reported to Google on April 27, 2026, by an anonymous researcher identified as 303f06e3, earning a $55,000 bug bounty. This responsible disclosure allowed for a nearly seven-week window between the initial report and the public patch release.

In the same June 8, 2026 update, Google resolved 74 total vulnerabilities. According to the advisory cited by HelpNetSecurity, Google is intentionally limiting technical details during the rollout: "Access to bug details and links may be kept restricted until a majority of users are updated with a fix." This standard practice is designed to hinder reverse engineering by malicious actors.

CVE-2026-11645 marks the fifth Chrome zero-day of 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281. This pattern indicates sustained pressure on the V8 codebase and the Chrome renderer.

Remediation: Verify the Fleet and Force Restarts

The gap between a released patch and a protected browser is the critical blind spot in this case. While Chrome distributes automatic updates, the process requires a browser restart to take effect. Sessions left open for days, VDI terminals with persistent user profiles, and machines in standby mode all leave the renderer process exposed.

Organizations should prioritize three actions:

Verify installed versions across all endpoints. Target versions are 149.0.7827.102/.103 for Windows and macOS, and 149.0.7827.102 for Linux. Chrome Enterprise provides the necessary tools for centralized management.

Enforce browser restarts within defined maintenance windows. In VDI and terminal server environments, restarting is a managed action that requires coordination with the service desk.

Map invisible Chromium dependencies. Electron applications, CEF frameworks, and derivative browsers incorporate V8 but do not follow Google’s update schedule. While the brief does not document specific CI/CD compromises, logic suggests that environments using headless Chrome for automated testing share the same attack surface if not updated independently.

Verified Facts

The documented facts are definitive. CISA added CVE-2026-11645 to the KEV catalog on June 9, 2026, with a remediation deadline of June 23, 2026. The CISA-ADP CVSS 3.1 score is 8.8 HIGH (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Google confirms the existence of exploits in the wild. The patch is available in the specified Stable versions.

Unknowns and Limitations

The current brief does not document: the identity of the attacker or APT group; specific delivery vectors beyond a "crafted HTML page"; the presence of an associated sandbox escape; specific targeted sectors or victims; the final payload or post-exploitation objectives; the precise technical root cause within the V8 code; the public availability of PoCs or IOCs; or the exact date when in-the-wild exploitation began.

Google’s decision to restrict technical details during the rollout slows defensive research based on specific indicators, but aligns with standard zero-day management practices.

The Bottom Line

Five zero-days in six months is not a statistical anomaly; it is a measure of the browser's status as critical infrastructure. V8 is no longer just a technical component—it is the point where malicious code meets user data, and where a single malicious HTML page can compromise active sessions and resident memory.

CISA’s June 23 deadline is a significant institutional signal, but the immediate problem is more practical: millions of Chrome instances may be updated on disk but remain un-restarted, leaving the renderer vulnerable. The patch exists, but protection only begins after the restart.

Information has been verified against cited sources and is current as of the time of publication.

Sources

Sources and references