cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Google Patches Actively Exploited Chrome V8 Zero-Day CVE-2026-11645

· Original article ↗

Summary

Google patched actively exploited Chrome zero-day CVE-2026-11645, an out-of-bounds read/write flaw in V8 reportedly exploitable through crafted HTML. Fixes are rolling out for Chrome Stable on Windows, macOS, and Linux.

Key points

  • Google says an exploit for CVE-2026-11645 exists in the wild.
  • The high-severity flaw is an out-of-bounds read and write issue in Chrome’s V8 JavaScript engine.
  • The article says crafted HTML pages can exploit the flaw to execute code within the browser sandbox.
  • Google is rolling out patched Stable Desktop versions for Windows, macOS, and Linux.
  • The update may take days or weeks to reach all users; Chrome can check for and install updates automatically.
  • The article identifies this as the fifth Chrome zero-day Google has patched this year.

Article Details

Vulnerability Types
  • Out-of-bounds read
  • Out-of-bounds write
Severity
High
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1203 · Exploitation for Client ExecutionRemote attackers can exploit the Chrome V8 vulnerability through crafted HTML pages to execute code in the browser sandbox.

CVE

CVE-2026-11645Google · ChromeGoogle has released emergency Chrome updates to fix CVE-2026-11645, a zero-day in the V8 JavaScript engine that has been exploited in the wild.CVE-2026-2441Google · ChromeThis is the fifth Chrome zero-day patched this year, following earlier fixes for flaws including CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281.CVE-2026-3909Google · ChromeThis is the fifth Chrome zero-day patched this year, following earlier fixes for flaws including CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281.CVE-2026-3910Google · ChromeThis is the fifth Chrome zero-day patched this year, following earlier fixes for flaws including CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281.CVE-2026-5281Google · ChromeThis is the fifth Chrome zero-day patched this year, following earlier fixes for flaws including CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281.

Vendors

GoogleGoogle has released emergency Chrome updates to fix CVE-2026-11645, a zero-day in the V8 JavaScript engine that has been exploited in the wild.

Products

Google ChromeGoogle has released emergency Chrome updates to fix CVE-2026-11645, a zero-day in the V8 JavaScript engine that has been exploited in the wild.V8Google has released emergency Chrome updates to fix CVE-2026-11645, a zero-day in the V8 JavaScript engine that has been exploited in the wild.

Related Articles