Is CVE-2026-11645 actively exploited?

Yes. KEV Intelligence tracks CVE-2026-11645 as a known exploited vulnerability. Confidence is confirmed.

What exploitation activity has KEV Intelligence observed?

KEV Intelligence has not yet recorded sensor-observed exploitation attempts for CVE-2026-11645. Our sensors continue to monitor for activity targeting this CVE.

Which versions are affected?

CVE-2026-11645 affects Google Chrome. Reported affected version: 149.0.7827.103 to < 149.0.7827.103.

Yes. CVE-2026-11645 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. KEV Intelligence attested it 5 hours ahead of CISA.

CVE-2026-11645 Exploited in the Wild — Chrome

Q: What is CVE-2026-11645?

CVE-2026-11645 is an unauthenticated vulnerability affecting Google Chrome. Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Q: How should organizations remediate it?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Q: Is it in CISA KEV?

Yes. CVE-2026-11645 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. KEV Intelligence attested it 5 hours ahead of CISA.

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-11645 is an unauthenticated vulnerability affecting Google Chrome. Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a...

Is it exploited?

Yes. KEV Intelligence tracks this CVE as a known exploited vulnerability. Confidence is confirmed.

Who is affected?

Google / Chrome affected before 149.0.7827.103.

What should we do?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Overview

Chrome

Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Vendor Product Affected Status

Google Chrome Before 149.0.7827.103 Affected

Published: 08 Jun 2026
Exploitation Reported: 09 Jun 2026
Attack vector: Remote
Complexity: Low
Privileges: None
User interaction: Required

CVE References

CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-11645
chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01... chromereleases.googleblog.com · CVE Record https://chromereleases.googleblog.com/2026/06/stable-channel-update-f...
issues.chromium.org/issues/506689381 issues.chromium.org · CVE Record https://issues.chromium.org/issues/506689381

Exploitation evidence

Why KEV Intelligence marks this CVE as exploited

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploited in the wild

TheHackerNews

Recorded 09 Jun 2026

Independent exploitation attestation added to the KEV Intelligence record.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the KEV Intelligence Pro API.

Learn about Pro API access

Source	Added
TheHackerNews First	2026-06-09 13:20 UTC
CISA	2026-06-09 18:01 UTC
CVE	2026-06-09 18:01 UTC
All CISA Advisories	2026-06-09 20:20 UTC

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets: 0
User-Agents: 0

Raw values available in Pro and Enterprise.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No KEV Intelligence virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

No detection artifacts or sensor request patterns are available for this CVE yet.

Check back as sensor telemetry and scanner integrations are updated.

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

8.8 High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

2.2%

Weaknesses

Out-of-bounds Read CWE-125 Out-of-bounds Write CWE-787

Recent mention · Google Chrome Releases

Stable Channel Update for ChromeOS / ChromeOS Flex

The ChromeOS Stable channel is being updated to OS version 16667.47.0 (Browser version 149.0.7827.153) for most ChromeOS devices.If you find new issues, please let us know one of the following ways:File a bugVisit our ChromeOS communitiesGeneral: Chromebook Help CommunityBeta...

Read full advisory

All Mentions

Recent mention · Google Chrome Releases

Stable Channel Update for ChromeOS / ChromeOS Flex

Google Chrome Releases · 17 Jun 2026

The ChromeOS Stable channel is being updated to OS version 16667.47.0 (Browser version 149.0.7827.153) for most ChromeOS devices.If you find new issues, please let us know one of the following ways:File a bugVisit our ChromeOS communitiesGeneral: Chromebook Help CommunityBeta Specific: ChromeOS Beta Help CommunityReport an issue or send feedback on ChromeInterested in switching channels? Find out how.Luis MenezesGoogle ChromeOS ChromeOS Vulnerability Rewards Program Reported Bug Fixes:N/AOther 3rd Party Security Fixes Included:High Fixes [LPE] Patchpanel ConnectNamespace PID Gate Bypass...

Recent mention · All CISA Advisories

CISA Adds Three Known Exploited Vulnerabilities to Catalog

All CISA Advisories · 09 Jun 2026

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-7473 Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability CVE-2026-11645 Google Chromium V8 Out-of-Bounds Read and Write Vulnerability CVE-2026-20245 Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD)...

Recent mention · TheHackerNews

Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now

TheHackerNews · 09 Jun 2026

Google has released security updates to address 74 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-11645 (CVSS score: 8.8), has been described as an out-of-bounds memory access in V8, Chrome's JavaScript and WebAssembly engine. "Out-of-bounds read and write in V8 in Google Chrome prior to 149.0.7827.103

Recent mention · Google Chrome Releases

Stable Channel Update for Desktop

Google Chrome Releases · 08 Jun 2026

The Stable channel has been updated to 149.0.7827.102/.103 for Windows and Mac and 149.0.7827.102 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the LogSecurity Fixes and RewardsNote: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.This update includes 74 security fixes. Below, we highlight fixes that were contributed by external...

Timeline

From disclosure to observed exploitation

09 Jun 2026
KEV confirmed by All CISA Advisories

Exploitation attested by an external source
09 Jun 2026
KEV confirmed by CVE

Exploitation attested by an external source
09 Jun 2026
Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
09 Jun 2026
Added to KEV Intelligence KEV Feed

High-confidence, third-party attested exploitation
08 Jun 2026
CVE published

Vulnerability disclosed publicly
08 Jun 2026
CVE ID reserved

Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro pricing Read API docs

Evidence confidence and provenance
First-party sensor telemetry
PoC and scanner references
Affected versions and enrichment
Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-11645

Free JSON includes basic KEV fields

{
  "cve_id": "CVE-2026-11645",
  "confidence": "Confirmed",
  "cvss_score": 8.8,
  "cvss_estimated": false,
  "epss_score": 0.0219,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}

CVE-2026-11645

What security teams need to know first

Chrome

Tags

CVE References

Why KEV Intelligence marks this CVE as exploited

Exploited in the wild

Known exploited vulnerability sources

Operational artifacts and observed signals

Observed signals

Scanner coverage

Virtual patch status

Severity, weaknesses, and research context

Weaknesses

Stable Channel Update for ChromeOS / ChromeOS Flex

All Mentions

From disclosure to observed exploitation

KEV confirmed by All CISA Advisories

KEV confirmed by CVE

Added to CISA KEV

Added to KEV Intelligence KEV Feed

CVE published

CVE ID reserved

Automate this intelligence

Get alerts on high-impact exploitation