cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Google Patches Actively Exploited Chrome V8 Zero-Day

· Original article ↗

Summary

Google's Chrome 149 update fixes 74 vulnerabilities, including actively exploited CVE-2026-11645, a high-severity V8 out-of-bounds flaw that can enable remote code execution in the sandbox via crafted HTML.

Key points

  • Google's Chrome 149 update patches 74 vulnerabilities.
  • CVE-2026-11645 is a high-severity out-of-bounds read/write flaw in V8 and has been exploited in the wild.
  • A specially crafted HTML page can let a remote attacker execute arbitrary code inside the sandbox.
  • Details of the attacks are unavailable; the article speculates attackers likely chained the flaw with a sandbox escape.
  • Google says an anonymous researcher reported the flaw in late April and received a $55,000 reward.
  • The article identifies CVE-2026-11645 as the fifth Chrome zero-day exploited in 2026.

Article Details

Vulnerability Types
  • Out-of-bounds read/write
Severity
High
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1203 · Exploitation for Client ExecutionA specially crafted HTML page can exploit the V8 vulnerability to allow remote code execution inside Chrome's sandbox.

CVE

CVE-2026-11645The exploited vulnerability is tracked as CVE-2026-11645.CVE-2026-2441This is the fifth Chrome zero-day to be exploited in 2026. The others are CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281.CVE-2026-3909This is the fifth Chrome zero-day to be exploited in 2026. The others are CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281.CVE-2026-3910This is the fifth Chrome zero-day to be exploited in 2026. The others are CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281.CVE-2026-5281This is the fifth Chrome zero-day to be exploited in 2026. The others are CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281.

Vendors

GoogleGoogle on Monday announced a Chrome 149 update that patches 74 vulnerabilities, including a zero-day that has been exploited in the wild.

Products

Google ChromeGoogle on Monday announced a Chrome 149 update that patches 74 vulnerabilities, including a zero-day that has been exploited in the wild.

Related Articles