NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

Chrome V8 zero-day CVE-2026-11645 exploited through malicious web pages

Attackers exploited a Chrome V8 flaw through malicious web pages. Desktop Chrome and Microsoft Edge have fixes. Update your browser through its About page and relaunch it; users of other Chromium browsers should check their maker’s update.

What to do

In Chrome, open Help → About Google Chrome, install the available update and relaunch; in Edge, open Help and feedback → About Microsoft Edge and do the same. Install the latest offered version, rather than stopping at these June fixes. If you use Opera or another Chromium browser, check its maker’s update guidance.

Check your devices
  • Google Chromefixed in 149.0.7827.103 and later
  • Google Chromefixed in 149.0.7827.103 and later
  • Google Chromefixed in 149.0.7827.102 and later
  • Microsoft Edgefixed in 149.0.4022.62 and later

What’s happening

Google disclosed an exploited memory-access flaw in Chrome’s V8 engine on 8 June. A malicious web page could run an attacker’s code inside the browser sandbox. Desktop Chrome fixes were released that day, followed by an explicitly confirmed Edge Stable fix on 9 June. CISA also listed the vulnerability as exploited. Google’s release notice includes Linux version 149.0.7827.102, while its CVE description uses 149.0.7827.103 as the general cut-off. The reviewed reports do not identify the attackers or victims, and the search found no later attack attribution. Fix versions for other Chromium browsers were not established.

What
Flaw
Affects
Google Chrome desktop and Microsoft Edge Stable
Affected
Google Chrome before 149.0.7827.103, according to the vendor CVE description; Google's Linux fixed release is 149.0.7827.102
Microsoft Edge Stable versions preceding 149.0.4022.62
Fixed in
Google Chrome 149.0.7827.102/.103 for Windows and Mac
Google Chrome 149.0.7827.102 for Linux
Microsoft Edge Stable 149.0.4022.62
CVE
CVE-2026-11645
Since
8 June 2026
Closed
9 June 2026

Timeline

  1. New fixFixed

    Microsoft released Edge Stable 149.0.4022.62 and explicitly confirmed that it fixes CVE-2026-11645.

  2. CISA added

    CISA added the flaw to its Known Exploited Vulnerabilities catalogue, with a 23 June remediation deadline for US federal civilian agencies.

  3. Made publicPartly fixed

    Google disclosed CVE-2026-11645 and confirmed exploitation. It released Chrome 149.0.7827.102/.103 for Windows and Mac, and 149.0.7827.102 for Linux.

Sources

  1. Stable Channel Update for DesktopGoogle · 8 June 2026
  2. Release notes for Microsoft Edge Security Updates — June 9, 2026Microsoft · 9 June 2026
  3. CVE-2026-11645 DetailNIST · 23 July 2026
  4. Google patches new Chrome zero-day flaw exploited in the wildBleepingComputer · 9 June 2026
  5. Cyber Brief 26-07 — June 2026CERT-EU · 1 July 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from June 2026 · JSON · RSS