CVE-2026-11645: Google Chromium V8 Out-of-Bounds Read and Write Vulnerability

This vulnerability is an out-of-bounds read and write flaw in the V8 JavaScript engine used by Google Chromium. A remote attacker can trigger it with a crafted HTML page to execute arbitrary code inside the browser sandbox. The issue affects any browser that embeds Chromium, including Google Chrome, Microsoft Edge, and Opera.

How it works

The weakness belongs to the out-of-bounds write (CWE-787) and out-of-bounds read (CWE-125) classes. In these flaws, code reads or writes memory outside the intended buffer boundaries. An attacker supplies a specially formed HTML page that causes V8 to perform the invalid access during JavaScript execution.

• The crafted page is rendered in the browser, exercising the vulnerable code path in V8.
• Successful exploitation grants code execution within the renderer sandbox.
• Further sandbox escape or privilege escalation is required to affect the host system.

Am I affected? How to find it in your systems

Inventory all Chromium-based browsers and any embedded Chromium components in enterprise applications. Check installed browser versions and configurations against the vendor advisory for the affected range. Typical deployment locations include user workstations, virtual desktop images, and any internal web applications that ship a browser runtime.

• Query endpoint management tools for browser process names and version strings.
• Review web proxy or endpoint logs for unusual JavaScript execution patterns or renderer crashes that coincide with visits to untrusted sites.
• Confirm exact affected versions and configurations in the vendor advisory.

How to remediate

Apply the vendor-supplied update for the affected Chromium V8 component. After patching, verify that the update has been deployed across all browser instances and embedded runtimes. Follow any additional hardening steps listed in the vendor advisory for this class of memory-safety issue.

If you can't patch immediately

Apply mitigations per the vendor instructions. Where mitigations are unavailable, discontinue use of the product. For cloud-hosted instances, follow applicable BOD 22-01 guidance. Segment browser traffic, restrict rendering of untrusted content, and increase monitoring of renderer processes until patches can be applied.

If your data may have been exposed

Actively exploited vulnerabilities of this type can lead to breaches. You can run a free exposure scan of your email addresses to check known breach data.