This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Actively exploited vulnerability in Google Chrome V8
Google has released security updates for the Google Chrome web browser that fix a total of 74 vulnerabilities [1]. Among them is the high-severity vulnerability CVE-2026-11645 in the V8 JavaScript engine, which has already been observed being actively exploited [2][3]. To ensure optimal protection, users are advised to update without delay to versions 149.0.7827.102/.103 (Windows, Apple macOS) and to version 149.0.7827.102 (Linux) [1].
An unauthenticated remote attacker can execute arbitrary code inside the browser sandbox due to an out-of-bounds memory access error in the V8 JavaScript engine when processing a malicious HTML page [4][2].
The vulnerability is present in products:
- Windows:Google Chrome; >=149, <149.0.7827.102; >=149, <149.0.7827.103
- macOS:Google Chrome; >=149, <149.0.7827.102; >=149, <149.0.7827.103
- Linux:Google Chrome; >=149, <149.0.7827.102
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2026-11645 at cve.org, NVD
- CWE-125: Out-of-bounds Read at cwe.mitre.org
- CWE-787: Out-of-bounds Write at cwe.mitre.org
The vulnerability was publicly disclosed 8. 6. 2026.
Links
- [1] https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html
- [2] https://thehackernews.com/2026/06/chrome-v8-zero-day-cve-2026-11645.html
- [3] https://www.cisa.gov/news-events/alerts/2026/06/09/cisa-adds-three-known-exploited-vulnerabilities-catalog
- [4] https://nvd.nist.gov/vuln/detail/CVE-2026-11645
By CESNET, z.s.p.o. Michaela Jarošová on 12. 6. 2026.