Chrome V8 Zero-Day CVE-2026-11645: 5th Actively Exploited Chrome Bug of 2026 Hits 3.5B Users

CVE-2026-11645 is an out-of-bounds read and write flaw in V8, the JavaScript and WebAssembly engine embedded in Chrome and every Chromium-based browser. V8 uses just-in-time compilation: it monitors JavaScript execution patterns at runtime and compiles hot code paths to native machine instructions for speed. This process allocates typed arrays, objects, and compiled code regions in heap memory with defined size bounds. The vulnerability occurs when a JIT-compiled code path performs a read or write using an index or offset that V8 does not correctly validate, enabling access to memory outside the intended buffer boundary.

In a real attack, a visitor loads a crafted HTML page containing attacker-supplied JavaScript. The script triggers V8's JIT compiler to process a specific execution pattern that exposes the out-of-bounds access flaw. The resulting memory operation writes attacker-controlled data to a heap region adjacent to the target buffer — heap corruption. At this point, the attacker can overwrite V8 internal data structures: typed array length fields, function pointers, or object metadata. Corrupting these structures converts the initial out-of-bounds write into a general read/write primitive anywhere in the V8 heap.

From that primitive, standard browser exploit techniques apply: an information leak bypasses ASLR by revealing heap layout; pointer corruption redirects a function call to attacker-controlled shellcode; execution occurs inside Chrome's renderer process. Google withheld the specific technical details of CVE-2026-11645 while the fix propagated — standard responsible disclosure practice. However, active exploitation is confirmed, meaning at least one threat actor has a working, weaponized exploit chain. Organizations should plan defenses assuming the attacker achieves renderer-level code execution at minimum.

CVE-2026-11645 affects all Google Chrome versions prior to 149.0.7827.103 on Windows and macOS, and prior to 149.0.7827.102 on Linux. Because V8 is the shared JavaScript engine for every Chromium-based browser, any browser built on the Chromium open-source project is affected until its vendor applies the corresponding V8 patch. Affected browsers include Google Chrome, Microsoft Edge, Brave, Opera, Vivaldi, Samsung Internet, and any other Chromium derivative.

Chrome holds approximately 65% global browser market share. With 5.5 billion internet users worldwide, that represents over 3.5 billion potential targets reachable through a single crafted web page. Enterprise networks typically run mixed browser environments: managed Chrome on corporate endpoints, Chromium derivatives on developer workstations, and browser-rendered content in kiosks or lab systems. Any of these is a valid exploitation target.

Microsoft had not yet issued a public Edge patched version statement as of June 30, 2026. Organizations relying on Edge should monitor the Microsoft Security Response Center; Edge typically patches its V8 component within 1 to 3 days of Google's Chrome release. Brave, Opera, and Vivaldi follow similar timelines. For enterprise management: Google Admin Console users can force-push Chrome 149.0.7827.103 via Devices > Chrome > Apps & extensions. Intune or Group Policy deployments should update the Chrome ADMX-targeted installer version immediately.

The vulnerability was discovered by researcher "303f06e3" and reported on April 27, 2026, earning a $55,000 bug bounty. Google patched and released 149.0.7827.103 shortly thereafter. The gap between discovery and confirmed exploitation indicates threat actors found or acquired the vulnerability independently, gaining approximately a five-week zero-day window before the fix was available.

CVE-2026-11645 is the fifth Chrome vulnerability confirmed exploited in the wild in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281. A rate of roughly one exploited browser zero-day per month is consistent with nation-state and commercial surveillance operator targeting of browser infrastructure as a reliable initial access vector.

Browser zero-days occupy a specific and high-value position in the exploitation toolkit: they require no valid credentials, no VPN access, no file download, and no user error beyond loading a page. The attacker controls delivery — through malvertising on legitimate ad networks, iframe injection on compromised websites, targeted phishing links, or direct access via social engineering. A single malicious page deployed at scale can reach millions of unpatched users in hours.

The previous Chrome zero-day in this sequence, CVE-2026-5281, was exploited within days of patch release — a pattern called patch diffing, where researchers reverse-engineer the fix to reconstruct the vulnerability. Organizations that delayed patching CVE-2026-5281 faced active exploitation before remediation. CVE-2026-11645 follows the same risk arc. The patch is available today; exploitation is confirmed; the attacker's advantage shrinks as patching spreads.

This pattern is also relevant for the broader June 2026 patch cycle, which addressed six zero-days across multiple Microsoft products. Browser zero-days and OS zero-days are converging into a sustained exploitation campaign environment where patch velocity is the primary defensive variable. Five browser zero-days in one year demands automated, verified browser update enforcement — not a policy that permits 30-day patch windows.

Google has not published specific network indicators — IP addresses, domains, or file hashes — for the CVE-2026-11645 exploitation campaign. This is standard practice when restricting details pending broad patch propagation. Detection for this CVE relies on behavioral and endpoint signals rather than IOC matching.

Chrome renderer process crashes immediately before or during a site visit are the earliest available signal. Browser crashes during normal usage are rare on modern hardware; a crash correlated with a visit to an unfamiliar URL warrants investigation. Chrome's local crash log (chrome://crashes/) and endpoint crash telemetry in EDR platforms should be reviewed for spikes following external web activity. Behavioral IOCs to monitor:

Patching Chrome is the highest-impact, lowest-effort remediation action available for CVE-2026-11645. The fix is already deployed in Chrome 149.0.7827.103 — no emergency hotfix download, no vendor account required, and no downtime for most environments. Apply before end of business today.

Browser zero-day exploitation is the most scalable initial access vector that does not require user error. A phishing attack needs someone to click and open an attachment. A browser zero-day needs someone to visit a page. The attacker controls when and how that visit happens — through malvertising, iframe injection on compromised legitimate sites, targeted phishing links, or direct access through social engineering. The victim organization's users navigate the web as part of their normal workday. That is the attack surface.

CVE-2026-11645's confirmed in-the-wild exploitation means at least one threat actor has a fully weaponized drive-by exploit chain targeting Chrome users today. The five Chrome zero-days in 2026 establish a sustained pattern: sophisticated adversaries, whether nation-state or commercial surveillance operators, do not deploy browser exploits once. They build chains and use them systematically across multiple targets until detection or patching eliminates the vector.

Browser version enforcement is among the most commonly undermanaged enterprise security controls. Auto-update policies exist but are frequently disabled on locked-down endpoints, suppressed by proxy configurations, or delayed by 30-day maintenance windows. The result is an inventory of unpatched browsers that provides drive-by exploit access to attackers who know this. Malicious Chrome extensions compounded this risk earlier in 2026 — CVE-2026-11645 operates at a lower level, in the engine itself, and cannot be blocked by extension policy.

Chrome V8 zero-day CVE-2026-11645 is patched, available, and deployable in under two minutes per endpoint. The only remaining exposure window is the gap between "patch available" and "all endpoints patched." Close it today.