CVE-2026-11645: Google Chrome V8 out-of-bounds read and write enables sandbox code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityRemote code execution in a widely deployed browser with confirmed KEV exploitation, though it requires user interaction and the record shows no ransomware use.

What it is

Google Chrome before 149.0.7827.103 contains an out-of-bounds read and write in the V8 JavaScript engine. A crafted HTML page can trigger the memory corruption, and because V8 is the browser's script engine, the flaw sits directly in the path of untrusted web content. It matters because it allows remote code execution inside the browser sandbox and is listed in CISA KEV.

Impact

An attacker who gets a victim to load a crafted page can corrupt V8 memory and execute arbitrary code inside the Chrome sandbox. The CVSS vector rates high confidentiality, integrity and availability impact, so full compromise of the renderer process is the expected outcome.

Attack surface

Reached over the network through a crafted HTML page rendered by Chrome; no authentication is required, but the CVSS vector requires user interaction (UI:R), meaning the victim must open or visit the page. No other attack vector is described in the record.

Exploitation

CVE-2026-11645 was added to CISA KEV on 2026-06-09 with a remediation due date of 2026-06-23, indicating known exploitation. EPSS is 0.0219 (81.5th percentile), and the record does not document ransomware campaign use.

What to do

• Update Chrome to 149.0.7827.103 or later on all managed endpoints, and verify the version after updating.
• Apply the vendor mitigations referenced in the Chrome stable channel release notes and follow BOD 22-01 guidance for cloud services.
• If immediate patching is not possible, restrict or discontinue use of affected Chrome builds per CISA's required action.
• Enforce automatic browser updates and block users from deferring restarts that leave old builds running.
• Track the CISA KEV due date of 2026-06-23 and confirm remediation before it passes.

Detection

• Inventory Chrome versions across endpoints and alert on any build below 149.0.7827.103.
• Monitor for Chrome renderer crashes or abnormal process terminations that could indicate V8 memory corruption attempts.
• Hunt for suspicious child processes or unexpected code execution originating from Chrome renderer processes.
• Review web proxy and DNS logs for delivery of exploit pages to users running unpatched Chrome.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.