Back to overview

CVE-2026-11645

HIGH KEV CISA Exploitation: ACTIVE
8.8
CVSS 3.1
Description
Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Metadata

CVE ID
CVE-2026-11645
State
PUBLISHED
Assigner
Chrome
Reserved
2026-06-08 21:33 UTC
Published
2026-06-08 23:27 UTC
Last updated
2026-06-10 03:58 UTC
Primary CWE
CWE-125
CWE-125 Out-of-bounds Read
Vendor / Product
Google / Chrome
Sources
cve.org  ·  NVD

Severity & Metrics

8.8 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
ACTIVE
Automatable
no
Tech. Impact
total
CISA Known Exploited Vulnerability
Vulnerability name
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
Vendor
Google
Product
Chromium V8
Added to KEV
2026-06-09
Due date
2026-06-23
Ransomware
Not known
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA description
Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Affected products (1)
VendorProductPlatformVersions
Google Chrome — 149.0.7827.103 < 149.0.7827.103
Weakness (CWE)
CWESourceDescription
— cna Out of bounds memory access
CWE-125 adp CWE-125 Out-of-bounds Read
CWE-787 adp CWE-787 Out-of-bounds Write
CVSS scores (1)
ScoreSeverityVersionSourceVector
8.8 HIGH 3.1 adp CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References (2)
Back to overview