Out-of-bounds read/write in Google Chromium V8 (CVE-2026-11645) — code execution via a crafted HTML page, affecting Chrome, Edge, and more
Google's JavaScript engine "Chromium V8" has an out-of-bounds read and write vulnerability that could let a remote attacker execute arbitrary code inside the sandbox via a crafted HTML page. It can affect multiple Chromium-based browsers, including Chrome, Edge, and Opera. CISA listed it as known-exploited (KEV) (CVSS 8.8 High).
Key facts
- CVE IDCVE-2026-11645
- CVSS base score8.8 HIGH
- CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Affected (vendor / product)Google Chromium V8
- CWECWE-787, CWE-125
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-06-23 (U.S. federal civilian agencies, BOD 22-01)
Key points
- Out-of-bounds read/write (CWE-787 / CWE-125) in V8, the core Chromium JavaScript engine
- A crafted HTML page could lead to arbitrary code execution inside the sandbox
- Affects multiple Chromium-based browsers (Chrome, Edge, Opera) — a shared engine ripples widely
- Listed in CISA KEV = exploitation confirmed (CVSS 8.8 High)
- Response: update each browser to the latest version (restart to apply). Deadline June 23, 2026
- Chromium is the shared foundation of many browsers, so one engine fault reaches Chrome, Edge, Opera and others.
1The JavaScript engine behind Chromium
CVE-2026-11645 is an out-of-bounds read and write vulnerability (CWE-787: out-of-bounds write / CWE-125: out-of-bounds read) in V8, the JavaScript engine at the core of Chromium browsers. It was added to CISA's KEV catalog on June 9, 2026.
2An attack from a crafted HTML page
Per NVD, an attacker could execute arbitrary code inside the sandbox via a crafted HTML page. Crucially, the impact is not limited to Google Chrome: NVD states it could affect multiple browsers that use Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Because Chromium is the shared foundation for many browsers, a single engine flaw ripples across a wide range of them.
3Why the browser is the front line
Browsers are a front-line asset where users routinely encounter malicious sites. Out-of-bounds read/write is a classic vulnerability that can lead to code execution via memory corruption, and browser zero-days have repeatedly been exploited in targeted attacks. Even though execution is within the sandbox, the KEV listing pushes for prompt updates.
4One fault in one engine reaches many browsers
The impact does not stop at Google Chrome. Chromium is the shared foundation of many browsers, so a single engine fault propagates broadly.
NVD states explicitly that it "could affect multiple web browsers using Chromium, including but not limited to Google Chrome, Microsoft Edge and Opera." A browser is the front line, the asset through which users meet malicious sites daily. Chromium browsers update automatically by default, but restarting to make the update take effect is the point of the response.
Why it matters
A browser flaw in the shared Chromium engine that ripples widely to Chrome, Edge, Opera, and others. For device administrators, the priorities are enforcing browser auto-updates and confirming application via restart. It reaffirms the importance of responding to browser zero-days.
FAQ
What is V8?
Why are browsers other than Chrome affected?
What should I do?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).