AppYour homeOperatorJournalAlerts
Request an introduction
Security issueGoogle Chrome

CVE-2026-11645

A flaw that lets Chrome's JavaScript engine reach memory it shouldn't, letting a web page run code. Google fixed it in Chrome 149 on 8 Jun 2026. It’s being used in attacks.

CVE-2026-11645Out of bounds memory access in V8
Attacks
Used in attacksOn CISA's list of flaws used in attacks since 9 Jun 2026. Every Google flaw on the list
Affected
  • Google Chrome before 149.0.7827.102 (149.0.7827.103 on Mac)
  • Brave before 1.91.171, the first Brave built on Chromium 149.0.7827.103
  • Microsoft Edge, Opera, Arc, Vivaldi and other browsers built on Chromium, until each ships the fix
  • Apps built on Electron, which carry their own copy of Chromium, until each ships it
Fixed in
Chrome 149.0.7827.102 (149.0.7827.103 on Mac), released 8 Jun 2026
In Brave
Brave 1.91.171, built on Chromium 149.0.7827.103, released 9 Jun 2026
Severity
Rated high by Google. CVSS 8.8 out of 10 (high), scored by CISA.
Official name
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
What's known.From Google’s release notes, CISA's catalogue of exploited flaws and NVD, checked 23 Oct 2026.

What it is

V8 is the part of Chrome that runs the JavaScript in every web page. This flaw lets V8 read and write memory outside what it was given. Google, CISA and NVD describe the result the same way: a remote attacker can use a crafted web page to run code inside Chrome's sandbox.

Inside the sandbox, that code is fenced off from the rest of the Mac. Getting out takes a second flaw. Google hasn't said whether the attacks it knows of used one, or who was targeted.

Is it being used in attacks?

Yes. Google’s release notes for Chrome 149.0.7827.102 say: “Google is aware that an exploit for CVE-2026-11645 exists in the wild.”

CISA, the US cybersecurity agency, added it to its catalogue of known exploited vulnerabilities on 9 Jun 2026, the day after the fix. CISA lists a flaw only when it has reliable evidence of it being exploited, and gave US federal agencies until 23 Jun 2026 to fix it.

Google keeps bug details private until most people have updated, and CISA doesn’t say who was attacked or how.

What to do

  1. Update Chrome, then relaunch it.Chrome → About Google Chrome in the menu bar. Chrome downloads updates by itself but only applies them when it relaunches, with your tabs.
  2. Do the same in every other browser you use.Brave, Edge, Arc, Vivaldi and Opera each have an About page in the app menu that checks for updates.
  3. Update apps built on Electron.Slack, Discord, Notion and many others carry their own copy of Chromium. The HARD app lists which ones on your Mac are behind.

Sources

  1. Stable Channel Update for Desktop: Chrome 149.0.7827.102/103The fix, rated high by Google, and Google’s statement that an exploit exists in the wild.chromereleases.googleblog.com ·
  2. Brave 1.91.171 (Chromium 149.0.7827.103)The first Brave release built on a Chromium with the fix.github.com/brave ·
  3. Known Exploited Vulnerabilities catalog: CVE-2026-11645Added 9 Jun 2026: CISA has evidence it is being used in attacks.cisa.gov ·
  4. CVE-2026-11645The official description, and a CVSS score of 8.8 out of 10 from CISA.nvd.nist.gov ·
Every advisoryLook up any app, company or CVEThe HARD Mac app links its warnings here.