Google shipped a Chrome update on June 8 that fixes 74 security vulnerabilities, including CVE-2026-11645, an out-of-bounds read and write bug in the V8 JavaScript engine that the company says is being exploited. "Google is aware that an exploit for CVE-2026-11645 exists in the wild," the release notes state.
A remote attacker can use the bug to run code inside Chrome's sandbox through a crafted HTML page, according to NVD. Because it only requires a victim to load a web page, flaws of this type are often paired with a sandbox escape in targeted attacks. It was the fifth exploited Chrome zero-day Google had fixed in 2026, according to Help Net Security.
What was fixed
The release brings Chrome to 149.0.7827.102/.103 on Windows and Mac and 149.0.7827.102 on Linux. An anonymous researcher reported the V8 bug on April 27. Google has not shared details about who was exploiting it.
The update is unusually large. Of the 74 fixes, 17 are rated Critical, almost all of them use-after-free bugs found internally by Google in components such as Ozone, Bluetooth, Autofill, Printing and the libyuv image library. Dozens more are rated High.
CISA added CVE-2026-11645 to its Known Exploited Vulnerabilities catalog on June 9 and set a June 23 deadline for U.S. federal agencies.
What to do
- Update Chrome through Help, then About Google Chrome, and relaunch the browser.
- Apply the matching updates for Microsoft Edge and other Chromium-based browsers as their vendors release them.
- IT teams should verify the version across managed devices rather than relying on automatic updates, which only take effect after a restart.
The vulnerability in this story
-
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
Exploited in the wild, listed by CISA on Jun 8, 2026
Scores and dates: NVD (not endorsed by the NVD). Each ID opens its record on cve.org.
