Google Chrome Zero-Day CVE-2026-11645: Fifth 2026 Exploit

Google has released an emergency security update for Chrome to fix CVE-2026-11645, a high-severity zero-day vulnerability in the V8 JavaScript engine that is already being exploited in the wild. Consequently, this marks the fifth actively exploited Chrome zero-day patched since the start of 2026, underscoring an accelerating threat against the world’s most popular browser.

What Happened: Google Patches Fifth Chrome Zero-Day of 2026

On Monday, June 8, 2026, Google published a stable channel security advisory acknowledging active exploitation of CVE-2026-11645. Furthermore, the company released patched builds for Windows, macOS, and Linux within hours of the disclosure.

The flaw is an out-of-bounds read and write vulnerability inside the Chrome V8 engine. Moreover, remote attackers can exploit it via a crafted HTML page to achieve arbitrary code execution within the browser sandbox. Successful exploitation also enables heap corruption, which can bypass ASLR protections and make further exploitation easier.

Technical Details of the CVE-2026-11645 Vulnerability

CVE-2026-11645 (high severity) stems from improper memory access in the V8 JavaScript engine. In addition, the bug allows a remote attacker to read and write beyond allocated buffer boundaries by tricking a user into visiting a malicious web page.

• CVE ID: CVE-2026-11645
• CVSS Score: High (Chromium security severity: High)
• Attack Vector: Network — crafted HTML page
• Prerequisites: User visits attacker-controlled page
• Privileges Required: None
• Impact: Remote code execution inside sandbox, ASLR bypass

Google has deliberately withheld full technical details and exploit links. Therefore, the advisory notes that access to bug specifics will remain restricted until a majority of users receive the fix.

Business and Operational Impact

Chrome holds a dominant share of the browser market across consumer, enterprise, and government environments. Thus, an actively exploited zero-day in its core engine poses broad risk.

• Enterprise Exposure: Organizations relying on Chrome for SaaS, webmail, and line-of-business applications face direct drive-by download and credential-theft risks.
• ASLR Bypass: The vulnerability weakens a fundamental memory-protection layer, making it easier to chain with additional bugs for full system compromise.
• Patch Latency: Google warns that the update may take days or weeks to reach every user, leaving a window for exploitation.
• Threat Actor Sophistication: Historically, Chrome zero-days are used by advanced persistent threat groups and spyware vendors tracked by Google’s Threat Analysis Group.

Mitigation and Recommendations

Immediate action is required for all Chrome users, especially in enterprise and government settings. The following steps reduce exposure:

1. Update Chrome immediately. Navigate to Settings → About Chrome and install version 149.0.7827.102 or later on Windows and Linux, or 149.0.7827.103 on macOS.
2. Verify auto-update is enabled. Chrome will apply the patch automatically on restart, but confirm the setting in enterprise managed policies.
3. Review browser security baselines. Ensure that Safe Browsing and site isolation are active to limit sandbox escape impact.
4. Monitor for indicators of compromise. Watch for unexpected renderer crashes, suspicious HTML attachments, and unusual outbound network connections from Chrome processes.

Immediate Actions for Enterprise Defenders

1. Force the update via Google Update (Omaha) or endpoint-management tools within 24 hours.
2. Audit managed Chrome devices for versions below 149.0.7827.102/103.
3. Consider blocking untrusted web content until patching is confirmed on critical systems.

Bottom line: CVE-2026-11645 is a confirmed in-the-wild Chrome zero-day that enables remote code execution and ASLR bypass. Update Chrome now to version 149.0.7827.102 or later to close the window of opportunity for attackers.

Incident Summary

CVE ID / Incident:	CVE-2026-11645 (NVD)
Affected Systems:	Google Chrome (Stable Desktop) on Windows, macOS, and Linux
Disclosure Date:	June 8, 2026
Patch Status:	Patched — Chrome 149.0.7827.102 (Win/Linux), 149.0.7827.103 (Mac)

References

1. Google Chrome Releases, “Stable Channel Update for Desktop,” June 8, 2026, https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html, accessed June 9, 2026.
2. National Vulnerability Database, “CVE-2026-11645 Detail,” NIST, https://nvd.nist.gov/vuln/detail/CVE-2026-11645, accessed June 9, 2026.
3. Sergiu Gatlan, “Google patches new Chrome zero-day flaw exploited in the wild,” BleepingComputer, June 9, 2026, https://www.bleepingcomputer.com/news/security/google-patches-fifth-chrome-zero-day-bug-exploited-in-attacks-this-year/, accessed June 9, 2026.
4. Google Chromium Issues Tracker, Issue 506689381, https://issues.chromium.org/issues/506689381, accessed June 9, 2026.