{"id":"chrome-v8-zero-day-jun-2026","category":"patch","status":"closed","title":"Chrome V8 zero-day CVE-2026-11645 exploited through malicious web pages","tldr":"Attackers exploited a Chrome V8 flaw through malicious web pages. Desktop Chrome and Microsoft Edge have fixes. Update your browser through its About page and relaunch it; users of other Chromium browsers should check their maker’s update.","summary":"Google disclosed an exploited memory-access flaw in Chrome’s V8 engine on 8 June. A malicious web page could run an attacker’s code inside the browser sandbox. Desktop Chrome fixes were released that day, followed by an explicitly confirmed Edge Stable fix on 9 June. CISA also listed the vulnerability as exploited. Google’s release notice includes Linux version 149.0.7827.102, while its CVE description uses 149.0.7827.103 as the general cut-off. The reviewed reports do not identify the attackers or victims, and the search found no later attack attribution. Fix versions for other Chromium browsers were not established.","action":"In Chrome, open Help → About Google Chrome, install the available update and relaunch; in Edge, open Help and feedback → About Microsoft Edge and do the same. Install the latest offered version, rather than stopping at these June fixes. If you use Opera or another Chromium browser, check its maker’s update guidance.","product":"Google Chrome desktop and Microsoft Edge Stable","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-11645"],"tags":["google","chrome","chromium","edge","zero-day","browser"],"affected":["Google Chrome before 149.0.7827.103, according to the vendor CVE description; Google's Linux fixed release is 149.0.7827.102","Microsoft Edge Stable versions preceding 149.0.4022.62"],"fixed":["Google Chrome 149.0.7827.102/.103 for Windows and Mac","Google Chrome 149.0.7827.102 for Linux","Microsoft Edge Stable 149.0.4022.62"],"matches":[{"platform":"windows","app":"Google Chrome","bundle":"","fixed":"149.0.7827.103"},{"platform":"macos","app":"Google Chrome","bundle":"com.google.Chrome","fixed":"149.0.7827.103"},{"platform":"linux","app":"Google Chrome","bundle":"","fixed":"149.0.7827.102"},{"platform":"edge","app":"Microsoft Edge","bundle":"","fixed":"149.0.4022.62"}],"sources":[{"kind":"advisory","title":"Stable Channel Update for Desktop","url":"https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html","by":"Google","date":"2026-06-08"},{"kind":"advisory","title":"Release notes for Microsoft Edge Security Updates — June 9, 2026","url":"https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security","by":"Microsoft","date":"2026-06-09"},{"kind":"advisory","title":"CVE-2026-11645 Detail","url":"https://nvd.nist.gov/vuln/detail/cve-2026-11645","by":"NIST","date":"2026-07-23"},{"kind":"news","title":"Google patches new Chrome zero-day flaw exploited in the wild","url":"https://www.bleepingcomputer.com/news/security/google-patches-fifth-chrome-zero-day-bug-exploited-in-attacks-this-year/","by":"BleepingComputer","date":"2026-06-09"},{"kind":"research","title":"Cyber Brief 26-07 — June 2026","url":"https://cert.europa.eu/publications/threat-intelligence/cb26-07/","by":"CERT-EU","date":"2026-07-01"}],"started":"2026-06-08","closed":"2026-06-09","created":"2026-11-03T20:14:07.249Z","updated":"2026-11-03T20:14:07.249Z","cve_notes":[{"cve":"CVE-2026-11645","name":"Out-of-bounds memory access in Chrome V8","what":"An out-of-bounds read and write in Chrome’s V8 engine lets a malicious web page run attacker-controlled code inside the browser sandbox.","severity":"high","cvss":8.8}],"timeline":[{"at":"2026-06-09","added":"2026-11-03T20:12:05.486Z","kind":"new-fix","text":"Microsoft released Edge Stable 149.0.4022.62 and explicitly confirmed that it fixes CVE-2026-11645.","url":"https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security","by":"Microsoft","patch":"patched"},{"at":"2026-06-09","added":"2026-11-03T20:12:05.486Z","kind":"cisa-added","text":"CISA added the flaw to its Known Exploited Vulnerabilities catalogue, with a 23 June remediation deadline for US federal civilian agencies.","url":"https://nvd.nist.gov/vuln/detail/cve-2026-11645","by":"NIST","patch":null},{"at":"2026-06-08","added":"2026-11-03T20:12:05.486Z","kind":"disclosed","text":"Google disclosed CVE-2026-11645 and confirmed exploitation. It released Chrome 149.0.7827.102/.103 for Windows and Mac, and 149.0.7827.102 for Linux.","url":"https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html","by":"Google","patch":"partial"}],"url":"https://hard.fyi/live/chrome-v8-zero-day-jun-2026/","json":"https://hard.fyi/api/live?id=chrome-v8-zero-day-jun-2026"}