Chromium V8 Engine

CVE-2026-11645 – Out-of-Bounds Read/Write in V8 JavaScript Engine Leading to Sandbox Escape and Remote Code Execution

Affects

• Google Chrome and all Chromium-based browsers
• Versions:
  • Google Chrome (Windows/Linux): prior to 149.0.7827.102
  • Google Chrome (macOS): prior to 149.0.7827.103
  • Microsoft Edge: prior to 149.0.4022.69
  • Brave, Vivaldi, Opera and other Chromium-based browsers (need vendor confirmation)
• Components:
  • V8 JavaScript and WebAssembly engine
• Files:
  • V8 memory management routines handling bounds checking
• Functions:
  • Improper validation of array indices and memory access patterns during JavaScript compilation and execution

Description

CVE-2026-11645 is a critical high-severity zero-day vulnerability in the V8 JavaScript engine, discovered by an anonymous researcher and actively exploited in the wild since before June 2026 . This is the fifth Chrome zero-day patched in 2026, highlighting the continued targeting of browser engines .

The vulnerability manifests as an out-of-bounds read and write condition that occurs when processing specially crafted HTML content . The issue stems from inadequate bounds checking within V8’s memory management routines, where malicious input triggers memory access violations that can be exploited to manipulate program execution flow .

When Chrome processes malformed HTML elements or JavaScript code, the engine fails to properly validate array indices or memory access patterns, creating opportunities for attackers to read beyond allocated memory boundaries or write data to unauthorized memory locations . The vulnerability exploits the fundamental trust model between JavaScript execution and system memory management, allowing attackers to craft HTML pages that trigger memory corruption during normal browser operations .

The flaw is particularly concerning because V8 processes JavaScript from every website a user visits, making any drive-by delivery mechanism viable . The attacker needs only to direct a victim to a malicious webpage; no further user interaction is required .

Attack Vector

Primary Attack Vector:
Remote / Network (requires website access)

Attack Scenario:

1. An attacker creates a malicious HTML page with crafted JavaScript that triggers the out-of-bounds read/write vulnerability in V8
2. The attacker hosts the page on a website, compromises a legitimate site, or uses email phishing to direct victims
3. A victim visits the page using a vulnerable browser (Chrome, Edge, Brave, etc.)
4. The crafted JavaScript triggers memory corruption within V8’s execution pipeline
5. The attacker can then execute arbitrary code inside the browser sandbox

Key Characteristics:

Conditions Affecting Risk:

• Any user browsing the internet with an unpatched Chromium-based browser is at immediate risk
• The vulnerability can be triggered by simply visiting a webpage with no additional user action
• All Chromium-based browsers (Edge, Brave, Opera, Vivaldi) share the V8 engine and remain exposed until patched

Impact

Successful exploitation allows a remote attacker to:

• Execute arbitrary code inside the browser’s sandboxed environment
• Read or manipulate memory beyond intended boundaries
• Expose sensitive information stored in browser memory (credentials, session data)
• Bypass security protections such as ASLR (Address Space Layout Randomization)
• Chain with other vulnerabilities to achieve broader system compromise
• Trigger browser crashes through heap corruption

Secondary Impacts:

• Credential theft and session hijacking
• Malware delivery and ransomware deployment
• Espionage and surveillance activities
• Bypass of browser sandbox protections designed to isolate web content from system resources

Observed Exploitation & Threat Activity

• Discovery: Anonymous researcher; reported to Google
• Public Disclosure: June 8-9, 2026 (emergency update release)
• CVE Published: June 8, 2026
• CISA KEV Catalog: Added June 9, 2026
• CISA Due Date: June 23, 2026
• Active Exploitation Confirmed: Yes – in the wild
• Public PoC: Technical details withheld by Google until majority of users apply the update
• CVSS Score: 8.8 (High) from CISA-ADP
• This is the fifth Chrome zero-day of 2026

Severity & Metrics

• CVSS v3.1 (CISA-ADP): High (8.8)
• Attack Vector: NETWORK
• Attack Complexity: LOW
• Privileges Required: NONE
• User Interaction: REQUIRED
• Scope: UNCHANGED
• Confidentiality Impact: HIGH
• Integrity Impact: HIGH
• Availability Impact: HIGH

Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Additional Scoring:

• SSVC: Technical Impact: Total
• Chromium Security Severity: High

Relevant CWE:

• CWE-125 – Out-of-bounds Read
• CWE-787 – Out-of-bounds Write
• CWE-129 – Insufficient Bounds Checking (variant)

Patch & Vendor Status

• Official Patches Available: Yes – emergency updates released June 8-9, 2026
• Google Chrome:
  • Windows: 149.0.7827.102 or later
  • Linux: 149.0.7827.102 or later
  • macOS: 149.0.7827.103 or later
• Microsoft Edge: 149.0.4022.69 or later
• Brave: Version 1.87.188 or later
• Other Chromium browsers: Check vendor updates for patched releases

CISA KEV Catalog: Added June 9, 2026 – Required Action: Apply mitigations per vendor instructions by June 23, 2026

Patch Links:

• https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html
• https://issues.chromium.org/issues/506689381

Mitigation & Remediation

Immediate Actions

Critical Reminder: This vulnerability is actively exploited in the wild. Apply updates immediately .

Short-Term Defensive Measures

If patching cannot be applied immediately:

• Avoid untrusted websites – Exercise caution when browsing
• Use browser isolation – Run browsers in sandboxed or virtualized environments
• Implement web filtering – Restrict access to known malicious domains
• Monitor EDR alerts – Watch for suspicious browser behavior

Long-term Defensive Measures

• Maintain automatic browser updates – Ensure Chrome/Edge updates apply without manual intervention
• Implement enterprise browser management – Enforce version compliance across the organization
• Conduct vulnerability scans – Identify systems running outdated browser versions
• Educate users on risks of visiting untrusted websites
• Use endpoint protection to reduce impact of browser-based attacks

Detection & Monitoring

Recommended Detection Sources:

Indicators of Potential Exploitation:

• Unexpected browser crashes or performance issues
• Browser accessing known malicious domains
• Unusual child processes spawned from browser processes
• System compromises originating from web browsing activity
• Chained exploitation leading to privilege escalation

Detection Strategy:

1. Inventory all Chromium-based browsers across the organization
2. Check versions against patched releases:
   • Chrome/Linux/Windows: 149.0.7827.102 or higher
   • Chrome/macOS: 149.0.7827.103 or higher
   • Edge: 149.0.4022.69 or higher
3. Track CISA KEV Catalog – the vulnerability is listed with a June 23, 2026 due date
4. Monitor for technical details – Google has withheld specifics until a majority of users are protected
5. Check network security solutions for Chrome-based browser protections

Post-Incident Response

If exploitation is suspected:

1. Isolate affected system from the network immediately
2. Preserve forensic evidence (browser history, cache, system logs, memory dumps)
3. Update browser to the patched version
4. Scan for malware – use endpoint protection to check for persistent backdoors
5. Rotate credentials – change passwords for any accounts accessed on the compromised system
6. Audit for persistence – check for unauthorized browser extensions, unusual startup entries, modified system files
7. Assume data exposure if sensitive information was accessible during exploitation
8. Report to relevant CSIRT/CERT authorities as required

For Enterprise Environments:

• Apply patches through enterprise deployment tools immediately
• Monitor for other compromised systems in the network
• Review security monitoring and logging capabilities to detect anomalous browser behavior

References

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html
• https://issues.chromium.org/issues/506689381
• https://nvd.nist.gov/vuln/detail/CVE-2026-11645
• https://www.cert.ug/index.php/google-chrome-v8-zero-day-under-active-exploitation-cve-2026-11645
• https://www.govcert.gov.hk/en/alerts_detail.php?id=1921
• https://www.thaicert.or.th/en/2026/06/11/google-releases-emergency-update-to-patch-actively-exploited-chrome-zero-day-vulnerability/
• https://www.cirt.gov.jm/advisory/google-releases-emergency-patch-actively-exploited-chrome-zero-day-vulnerability-cve-2026
• https://vulnerability.circl.lu/vuln/CVE-2026-11645
• https://vuldb.com/cve/CVE-2026-11645
• https://cwe.mitre.org/data/definitions/125.html
• https://cwe.mitre.org/data/definitions/787.html