Google Chrome V8 Out-of-Bounds Read/Write Vulnerability (CVE-2026-11645) Advisory

1. Google Chrome Browser Update (Recommended)

Update your Chrome browser to the latest stable version immediately.

• Desktop (Windows/Mac/Linux): Navigate to Chrome Menu (⋮) -> Help -> About Google Chrome to trigger the automatic update.
• Enterprise Environment: Enforce automatic updates via Group Policy Objects (GPO) or centralized endpoint management tools.

2. Linux Chromium Package Update Example

# Debian/Ubuntu-based systems
sudo apt-get update && sudo apt-get --only-upgrade install google-chrome-stable -y

# RedHat/CentOS-based systems
sudo yum update google-chrome-stable -y

3. Temporary Mitigations (Prior to Patching)

• Restrict access to untrusted external websites and links received via unsolicited emails.
• Enable 'Enhanced Safe Browsing' in Chrome settings across enterprise endpoints to block known malicious URLs.

CVE-2026-11645 is a high-severity vulnerability involving both Out-of-Bounds Read (CWE-125) and Out-of-Bounds Write (CWE-787) within the V8 JavaScript and WebAssembly engine of Google Chrome.

An attacker can exploit this vulnerability by enticing a user to visit a specially crafted HTML page. By triggering improper memory boundary checks in V8, the attacker can read or write memory outside the allocated buffer, leading to arbitrary code execution within the browser's sandbox environment.

This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild, and carries a high EPSS score of 0.94. While the execution is restricted to the sandbox, it poses a severe threat as it can be chained with local privilege escalation (LPE) vulnerabilities to compromise the underlying operating system.