CVE-2026-11645

This bug is like a flaw in Chrome’s “brain” for running website code (JavaScript). A bad website can trick Chrome into reading or writing the wrong spot in memory, which can let an attacker run code on your machine (even though it’s meant to be contained inside a sandbox). For a business, that means a single visited web page could become a path to compromise.

This matters if you use Google Chrome on computers where staff browse the web, because the attack works when someone visits a crafted HTML page (no login needed), and it is reachable in typical default setups. You’re most at risk if your Chrome installations are not updated to 149.0.7827.103 or newer, since exploited web pages can trigger the bug just by viewing the page.

This is RED because it is already being exploited in the wild and it’s listed in CISA’s Known Exploited Vulnerabilities (KEV). Attackers can target employees by sending (or embedding) a crafted web page, aiming to run code in Chrome’s sandbox when it processes the malicious page; you should treat outdated Chrome as an active exposure today.

1. Confirm exposure (fast inventory)

   • On each device: open Chrome → Help → About Google Chrome and record the exact version.
   • Flag any device running a version earlier than 149.0.7827.103.

2. Patch (targeted remediation)

   • Update all flagged devices to Google Chrome fixed in 149.0.7827.103.
   • If you manage Chrome centrally, push the stable update via your normal software management process and ensure users cannot defer updates.

3. Time guidance

   • CISA KEV lists this CVE with a remediation due date of 2026-06-23; prioritize affected machines used for general browsing ahead of less-used systems.

4. Temporary workaround if update is delayed

   • Reduce exposure by limiting where staff can browse: use web filtering/allowlisting to block untrusted domains.
   • Where possible, route browsing through a managed/controlled environment (so risky pages are blocked or inspected) until all devices are updated.

5. Validate after patching

   • Re-check Chrome versions and confirm they are at least 149.0.7827.103.
   • Watch for unusual browser crashes or error patterns consistent with active exploitation attempts.

6. Ongoing monitoring

   • Have IT check endpoint logs for signs of compromise tied to the timeframe of web browsing incidents and confirm no persistence mechanisms were installed.

Severity is high: the vulnerability is an out-of-bounds read and write in Google Chrome’s V8 JavaScript engine that allows a remote attacker to execute arbitrary code within Chrome’s sandbox using a crafted HTML page. The required trigger is user browsing to a malicious page (no authentication required), meaning typical drive-by web exposure is in scope.

CISA KEV: CVE-2026-11645 is listed in CISA KEV (added 2026-06-09) with a remediation due date of 2026-06-23, and CISA requires mitigations per vendor guidance or discontinuation if mitigations aren’t available.

Exploitation status: News reporting states exploitation is active in the wild and that Google acknowledged a wildcard exploit exists for this CVE; the findings do not provide public exploit code availability. Technical maturity is therefore at least “exploited in the wild,” which warrants urgency beyond purely predictive risk.

EPSS: a prediction is provided (trend flat), but it should not be used to down-rank priority because KEV/news confirm exploitation.

CWE mapping: CWE-125 (out-of-bounds read) and CWE-787 (out-of-bounds write).