Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-11645 8.8
Google · Chromium V8 · Added 2026-06-09
3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityGoogle Chromium V8 Out-of-Bounds Read and Write Vulnerability
VendorGoogle
ProductChromium V8
Date added2026-06-09
Due date2026-06-23
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-125 CWE-787
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Descriptions

KEV: Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

NVD: Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Compliance SSVC + BOD 26-04

Automatableno
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline14 days
Forensic (public)Required
Forensic (non-public)Not required

Research metadata

Last researched2026-08-26 03:41 UTC
Wall time0.5s
Searches4
Component defaultunknown
Sources https://nvd.nist.gov/vuln/detail/CVE-2026-11645
https://www.penligent.ai/hackinglabs/cve-2026-11645-chrome-v8-zero-day/
https://threat-modeling.com/google-chromium-v8-rce-cve-2026-11645/
https://socprime.com/blog/cve-2026-11645-chrome-zero-day-vulnerability-exploited-in-the-wild/
https://www.sentinelone.com/vulnerability-database/cve-2026-11645/
https://github.com/fevar54/CVE-2026-11645-Out-of-bounds-Read-Write

Hunting hypothesis agent

Look for Chrome renderer crashes with SIGSEGV in V8 TurbofanOptimized frames in crash telemetry, as the PoC trains a function with thousands of JIT iterations before triggering OOB read/write manifesting as renderer access violations.

Research details

ComponentV8 JavaScript engine Turbofan JIT compiler, specifically incorrect bounds-check elimination during JIT compilation
PreconditionsGoogle Chrome prior to version 149.0.7827.103 (stable channel released June 8, 2026) is affected. All Chromium-based browsers sharing the same V8 engine version are affected, including Microsoft Edge, Opera, and Brave. The user must visit a malicious webpage (via phishing, compromised site, or malvertising) that contains JavaScript designed to trigger the vulnerability. The exploit trains the V8 JIT compiler on a crafted vulnerable function with thousands of iterations, then triggers an out-of-bounds read for memory layout leakage followed by an out-of-bounds write for memory corruption, achieving type confusion that leads to arbitrary code execution within the Chrome sandbox renderer process. No additional user interaction beyond page visit is required. The Chrome sandbox limits initial code execution to the renderer process; a separate sandbox escape exploit would be needed for full system compromise. agent
DeliveryA crafted HTML page delivered via phishing link, compromised website, or malvertising. The page contains JavaScript that allocates ArrayBuffers, trains the V8 JIT compiler on a vulnerable function with 10000 iterations, forces JIT optimization via %OptimizeFunctionOnNextCall, then triggers an OOB read followed by an OOB write to achieve type confusion and code execution in the renderer process. No user interaction beyond visiting the page is required.
Public PoCyes
PoC URLs https://github.com/fevar54/CVE-2026-11645-Out-of-bounds-Read-Write Third-party repos; verify before use.
Advisoryhttps://chromereleases.googleblog.com/search?q=CVE-2026-11645
Exploit notesPublic PoC available on GitHub (fevar54/CVE-2026-11645-Out-of-bounds-Read-Write) with a working exploit demonstrating the five-phase attack: memory preparation (ArrayBuffer allocation), JIT compilation training on a vulnerable function with 10000 iterations, OOB read for memory leak, OOB write for memory corruption, and type confusion for RCE. The PoC uses %OptimizeFunctionOnNextCall to force JIT optimization and includes a minimalist trigger.html variant. CVSS v3.1 attack complexity: LOW. Actively exploited in the wild as a zero-day prior to the June 8, 2026 stable channel patch. The vulnerability is in V8's Turbofan JIT compiler and provides code execution within the Chrome renderer sandbox; sandbox escape requires a separate chained exploit. Chromium issue tracker: Issue 506689381.
SummaryGoogle Chrome versions prior to 149.0.7827.103 contain a high-severity out-of-bounds read and write vulnerability (CVSS 8.8) in the V8 JavaScript engine's Turbofan JIT compiler. An attacker crafts a webpage with JavaScript that trains the JIT on a vulnerable function, triggering incorrect bounds-check elimination. This allows an OOB read to leak memory layout information followed by an OOB write to corrupt memory and achieve type confusion, leading to arbitrary code execution within the renderer process sandbox. A public PoC exploit is available on GitHub demonstrating the full attack chain across five phases. The vulnerability was actively exploited as a zero-day before Google released the stable channel patch on June 8, 2026. Multiple Chromium-based browsers (Chrome, Edge, Opera, Brave) are affected. CISA KEV added June 9, 2026.

Tia coverage

First reported2026-06-09
First exploit report2026-06-09
Exploit report → KEV0 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

google-fixes-actively-exploited-android-zero-day-on-pixel-devicegoogle-patches-5th-chrome-zero-day-of-2026-cve-2026-11645-v8-eng

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub