Actively exploited in the wild
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
Google - Chromium V8 · Listed in the CISA KEV since 2026-06-09. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2026-11645
HighCVSS 8.8KEVExploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
An out-of-bounds read and write vulnerability in the V8 engine in Google Chrome prior to 149.0.7827.103 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High.
Risk Assessment
An attacker can bypass browser sandboxing and execute code on the victim's machine, potentially leading to malware infection.
Recommendation
Update Google Chrome to version 149.0.7827.103 or later.
Original NVD description (English source)
Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)