Out of Bounds Read and Write in Google Chrome by Google
CVE-2026-11645
Key Information:
Badges
What is CVE-2026-11645?
false
CISA has reported CVE-2026-11645
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-11645 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace
The CISA's recommendation is: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected Version(s)
Chrome 149.0.7827.103
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
Emit PostCVE-2026-11645Google patches fifth exploited Chrome zero-day of the year
Google patched CVE-2026-11645, an actively exploited V8 flaw in Chrome and the fifth zero-day used in attacks this year. Update Chrome now.
3 weeks ago
The Hacker NewsCVE-2026-11645Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now
Google released security updates for 74 Chrome vulnerabilities, including CVE-2026-11645, a high-severity V8 out-of-bounds memory access flaw.
3 weeks ago
Google patches new Chrome zero-day flaw exploited in the wild
Google has released emergency updates to patch another Chrome zero-day vulnerability that has been exploited in the wild, the fifth such flaw patched since the start of the year.
3 weeks ago
References
CVSS V3.1
Timeline
- 📈
Vulnerability started trending
- 🟡
Public PoC available
- 👾
Exploit known to exist
- 🦅
CISA Reported
- 📰
First article discovered by BleepingComputer
Vulnerability published
Vulnerability Reserved