CVE-2026-11645: actively exploited Chrome V8 zero-day

Google fixed CVE-2026-11645 in the V8 JavaScript engine and confirmed that an exploit exists in real-world attacks. That is enough to make updates for Chrome and Chromium-based browsers urgent—without inventing an actor, target set or campaign scale that Google did not disclose.

What Google confirmed

In its stable-channel release announcement, Google rated CVE-2026-11645 as high severity. The issue is an out-of-bounds memory access in V8, which executes JavaScript in Chrome. The vendor also explicitly stated that it was aware of an exploit being used in the wild.

The release contained 74 security fixes in total. That does not mean every issue was exploited. Google’s active-exploitation statement applies to CVE-2026-11645.

The Canadian Centre for Cyber Security confirmed affected version ranges, and CISA added the issue to its Known Exploited Vulnerabilities catalogue.

Fixed versions

• Chrome on Windows and macOS: 149.0.7827.102 or 149.0.7827.103;
• Chrome on Linux: 149.0.7827.102;
• Microsoft Edge: 149.0.4022.62 or later.

If the browser reports a lower version, the device remains on an affected build. Automatic updates do not prove completion: rollout can be staged and a browser process running for days may still require restart.

Check Chrome at chrome://settings/help and Edge at edge://settings/help. Opening the page also triggers an update check. Close and reopen every browser window after installation.

Why a V8 memory bug matters

V8 processes code from visited websites. A memory-safety flaw can be triggered through crafted web content. Public information does not describe the complete exploit chain or conditions, so it is not accurate to claim that opening any suspicious page automatically compromises the operating system.

Defenders do not need the private exploit details to prioritise action. Browsers process untrusted content continuously, the vendor confirmed exploitation and KEV provides an evidence-based urgency signal.

User actions

1. Check the actual version rather than assuming updates completed.
2. Install the fixed or a later Chrome/Edge release.
3. Restart the browser so old processes stop using vulnerable code.
4. Update every profile and device, including personal computers used for work.
5. Never install a “browser patch” from an advertisement or email; use official update mechanisms.

If the operating system cannot run a supported browser release, leaving the old browser in place is not a safe solution. Move to a supported platform or a current supported alternative.

Administrator actions

Read actual browser versions through MDM, EDR or endpoint management and compare them with the fixed thresholds. Cover Chrome, Edge and other deployed Chromium browsers using their own vendor advisories.

Prioritise workstations with access to email, administrative consoles and sensitive data. Set a short deadline, enforce process restart and verify completion. This inventory–deploy–confirm loop belongs in a measurable vulnerability-management process.

If telemetry shows unusual child processes, unexpected extensions or anomalies on a previously vulnerable workstation, preserve evidence and investigate. Patching prevents future use of the specific flaw; it does not determine whether exploitation happened earlier.

The correct response to CVE-2026-11645 is fast and measurable: update Chrome to 149.0.7827.102/.103, Edge to at least 149.0.4022.62, restart and verify centrally.

---

Sources: Google Chrome Releases, Canadian Centre for Cyber Security, CISA KEV.