CVE-2026-11645 is an out-of-bounds read and write vulnerability in Google Chromium V8. CISA added it to the Known Exploited Vulnerabilities catalogue on 9 June 2026, which means attackers have used it in real attacks. Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
What this CVE means in practice
V8 is the JavaScript and WebAssembly engine inside Chromium, so an out-of-bounds read and write there is not just a crash condition, it is a memory-safety flaw in code that processes untrusted web content. In practical terms, a crafted page can become a delivery vehicle for arbitrary code execution inside the browser sandbox.
That combination matters because browser exploits are often used as an initial foothold: the attacker only needs a user to render hostile content, after which the exploit can be chained with a second-stage payload, sandbox escape, or credential theft attempt. A memory corruption bug in a browser engine is therefore dangerous even before it is paired with a broader intrusion campaign.
How organisations assess exposure
Exposure starts with knowing where Chromium-based browsers and embedded Chromium runtimes exist across endpoints, virtual desktops, managed devices, kiosks, and packaged applications. Teams should confirm whether internet-facing user workflows, email clients, chat tools, or web applications can render attacker-controlled HTML in a way that reaches the vulnerable engine.
Vendor advisories and the CVE Program record provide the canonical identifier, while the NIST National Vulnerability Database is the place to cross-check affected-product metadata, references, and remediation context. For fast prioritisation, organisations should also check whether their vulnerability management workflow already treats KEV-listed issues as urgent because this CVE was added to CISA’s Known Exploited Vulnerabilities catalogue.
Where browser builds are repackaged by vendors or bundled in enterprise software, the practical question is not only “Is Chrome installed?” but “Where is Chromium code actually executing, and can a malicious page reach it?” That is why inventory and internet-exposure review are both necessary.
Why this vulnerability is dangerous
Out-of-bounds read and write bugs can expose memory contents, corrupt execution state, and make exploitation more reliable than a simple crash-only defect. In a browser engine, that can translate into arbitrary code execution within a process that already has a large attack surface and handles hostile input continuously.
The danger increases when the weakness is actively exploited in the wild, because exploitation no longer depends on a theoretical proof of concept. For browser memory corruption, the attacker objective is usually to gain code execution first, then use that execution to steal data, stage further exploitation, or establish persistence outside the browser.
Remediation and verification
The safest response is to apply the vendor’s fixed build as soon as it is available for your platform, then verify deployment against the actual browser channels and embedded Chromium distributions in use. If immediate patching is not possible, reduce exposure by limiting untrusted browsing, tightening web content handling, and constraining who can reach high-risk sites or attachments.
After remediation, do not assume the issue is closed just because the browser version changed. Review whether suspicious downloads, unexpected script execution, or browser-process crashes occurred before patching, and check for follow-on compromise of sessions, saved credentials, or access tokens that may have been exposed during exploitation.
Risk and Threat Considerations
Browser memory corruption is attractive to attackers because it can be triggered remotely through ordinary web traffic and often requires little user interaction beyond opening a page. Once exploited, it may be used as the first stage of a broader intrusion, especially when paired with phishing, malvertising, or compromised sites.
Failure mechanism: A crafted page drives the V8 engine into reading or writing outside valid memory bounds, allowing the attacker to corrupt process state or steer execution.
Impact: The attacker may achieve arbitrary code execution inside the sandbox, use the browser as a foothold, and move toward data theft or further compromise if other controls fail.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1189 — Drive-by Compromise | CVE exploitation through a crafted HTML page matches browser-based initial access. |
| Recommendation — Monitor web-delivered exploit chains and correlate browser telemetry with initial-access alerts. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | This CVE requires rapid patching and verification after vendor release. |
| SI-4 — System Monitoring | Exploitation review depends on detecting crash, execution, and post-exploit activity. | |
| Recommendation — Prioritise remediation of the affected browser build and verify installation across endpoints. Review endpoint and browser telemetry for exploit indicators and suspicious post-patch activity. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | KEV-listed browser flaws need inventory, prioritisation, and remediation tracking. |
| CIS-8 — Audit Log Management | Post-exploitation review depends on preserved logs and event visibility. | |
| Recommendation — Track exposed browser instances and accelerate remediation for KEV-listed vulnerabilities. Preserve and review endpoint and browser logs to support compromise investigation. | ||
Practitioner Guidance
Why practitioners should care: Treat KEV-listed browser engine flaws as operationally urgent because they sit at the boundary between untrusted web content and high-value user sessions. Browser exploits often become the entry point for more serious compromise than the browser itself.
What to watch for: Prioritise patch verification, crash telemetry, unusual browser behaviour, and any signs that credentials or active sessions were used after the suspected exploit window. If you find evidence of exploitation, assume the browser was only the first step and investigate the host and identity impact as well.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org