cbcvebase.
CVE-2026-11645
published 2026-06-09

CVE-2026-11645: Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted…

PriorityP188high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2026-06-23
Exploited in the wild
EPSS
5.47%
90.4th percentile
Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Affected

3 ranges
VendorProductVersion rangeFixed in
googlechrome< 149.0.7827.103149.0.7827.103
googlechrome>= 149.0.7827.103 < 149.0.7827.103149.0.7827.103
googlechrome_desktop

Detection & IOCsextracted from sources · hover to see the quote

  • Vulnerability is actively exploited in the wild via crafted HTML pages targeting Chrome's V8 JavaScript/WebAssembly engine; any Chrome version prior to 149.0.7827.103 (Windows/macOS) or 149.0.7827.102 (Linux) is vulnerable
  • Exploitation vector is a crafted HTML page delivered remotely; monitor for suspicious HTML/JS content triggering V8 out-of-bounds memory access patterns
  • Chromium issue tracker ID 506689381 is the upstream bug reference; use this to correlate patch commits and PoC activity in public repositories
  • Scope extends beyond Chrome — Microsoft Edge, Brave, Opera, Vivaldi and other Chromium-based browsers are also affected; ensure detection/patching coverage includes all Chromium-based browser processes
  • CISA KEV remediation deadline is 2026-06-23; prioritise patching for Federal Civilian Executive Branch (FCEB) environments and treat any unpatched Chrome/Chromium instance as actively at risk
  • ·The fix version differs by OS: 149.0.7827.102/.103 for Windows and macOS, 149.0.7827.102 for Linux — version-based detection rules must account for this split
  • ·Red Hat rates severity as determined by Google's Chrome Security Advisory; downstream Chromium packages (e.g., chromium-browser RPM) are separately tracked and may lag behind upstream patch availability

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vulncheck8.8HIGH
cisa8.8HIGH
vendor_redhat8.8HIGH