Skip to main content
Mallory
High

Out-of-bounds read/write in V8 in Google Chrome

IdentifiersCVE-2026-11645CWE-787· Out-of-bounds Write

CVE-2026-11645 is a high-severity out-of-bounds memory access vulnerability in the V8 JavaScript engine used by Google Chrome. The issue is described as an out-of-bounds read and write affecting Google Chrome prior to 149.0.7827.103, and can be triggered by a remote attacker via a crafted HTML page. The flaw results in memory corruption within the browser’s renderer context and allows arbitrary code execution inside Chrome’s sandbox. Google has stated that exploitation exists in the wild. Publicly available information does not identify the specific vulnerable V8 function, and Google has restricted additional technical details pending broad patch adoption.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a remote attacker to achieve arbitrary code execution within the Chrome sandbox when a target visits a maliciously crafted HTML page. Because the flaw is an out-of-bounds read/write in V8, impact can also include memory corruption, renderer crashes, and unintended access to adjacent memory. The available reporting also indicates the bug may assist with information disclosure relevant to exploit reliability, such as exposing memory contents or aiding bypass of mitigations like ASLR. Google has confirmed in-the-wild exploitation, so the risk is not merely theoretical.

Mitigation

If you can’t patch tonight, do this now.

Primary mitigation is prompt patching and browser restart to activate the updated build. Until patch deployment is complete, reduce exposure by limiting access to untrusted websites and web content, using browser isolation or application sandboxing controls where available, and monitoring for signs of exploitation against Chrome renderer processes. Because exploitation is triggered via crafted HTML, restricting risky browsing activity and enforcing rapid browser update policies can reduce interim risk, but no complete mitigation short of patching is provided in the available information.

Remediation

Patch, then assume compromise.

Upgrade Google Chrome to version 149.0.7827.103 or later. Reported patched stable desktop builds include 149.0.7827.102 for Windows, 149.0.7827.103 for macOS, and 149.0.7827.102 for Linux; organizations should deploy the latest vendor-provided stable release available for their platform rather than relying on older fixed point versions. Apply updates across all managed desktop endpoints and ensure browsers are restarted so the patched build is actually loaded.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
GoogleChromeapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures1

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity16

Community discussion across Reddit, Mastodon, and other social sources.