Google Patches 5th Chrome Zero-Day of 2026 (CVE-2026-11645) — V8 Engine OOB Read/Write Exploited in the Wild

Google shipped emergency Stable channel updates on June 9, 2026, moving desktop Chrome to 149.0.7827.102 on Windows and Linux and 149.0.7827.103 on macOS to close CVE-2026-11645, a high-severity out-of-bounds read and write in the V8 JavaScript engine that Google confirms was exploited in the wild before the patch. The flaw is triggered by crafted HTML pages, yields code execution inside the renderer sandbox, and is reported to have potential for bypassing ASLR. The same release carries 18 vulnerability fixes, 10 of them use-after-free bugs, several in WebGL. CISA's KEV catalog already lists the CVE, and this is the fifth in-the-wild Chrome zero-day of 2026, following CVE-2026-2441 in February, CVE-2026-3909 and CVE-2026-3910 in March, and CVE-2026-5281 in April.

The mechanism is what makes this the story of the day: an out-of-bounds read and write in V8 turns any web page into the entire delivery chain, so the only prerequisite is getting a victim to load attacker-controlled script in a vulnerable build. The ASLR-bypass detail matters because it implies the read primitive feeds the write, the signature of an engineered exploit rather than a lab proof of concept, and the KEV listing confirms the US government treats it as a real intrusion vector with a remediation clock attached. The cadence is the deeper signal: five exploited browser zero-days in under six months, including two actively exploited this quarter alone, points to a functioning exploit pipeline aimed at the browser with the largest install base. It also means the patched-Chrome headline understates exposure, because Chromium-derived browsers and Electron applications inherit the same V8 code and remain vulnerable until their own vendors backport the fix, a lag measured in days to weeks.

Force the update rather than trusting the background updater: 149.0.7827.102 on Windows and Linux, 149.0.7827.103 on macOS, verified per endpoint at chrome://version. Push through GPO or MDM immediately, as the enterprise guidance in the release itself states, and inventory Chromium-derived browsers and Electron apps against their vendors' advisories for the same V8 backport, since the fleet is not safe until the last derived build ships it. Google has published no indicators or attack detail, so the hunt is behavioral: treat the KEV listing as the compliance deadline, and in EDR watch for browser processes spawning unexpected child processes or renderer crashes following web content loads, which are the observable artifacts of a sandboxed renderer being pushed out of bounds.

Two developments would change this assessment. A researcher writeup or Google addendum revealing the exploitation chain and indicators would convert patch urgency into a retroactive hunt mandate across retained telemetry. And a sixth in-the-wild zero-day arriving before July would confirm the roughly quarterly rhythm of 2026 and justify moving browser patching to a same-day SLA with update-state reporting on every managed endpoint.