Google Chrome V8 Engine Vulnerability (CVE-2026-11645) Exploited in the Wild

Google Chrome is the most widely used web browser across enterprises and personal devices globally. A critical vulnerability in Chrome’s V8 JavaScript and WebAssembly engine is being actively weaponised by threat actors in the wild. This flaw affects Google Chrome versions prior to 149.0.7827.103 and was addressed through security updates released by Google.

What is the Vulnerability

The Exploit Mechanism

Threat actors place malicious JavaScript on malicious or breached sites, triggering Chrome’s V8 engine to execute code upon user visit.

The Vulnerability

A V8 flaw (memory corruption or type confusion) causes improper memory bounds handling, allowing scripts to read or write outside designated browser buffers.

The Threat

Attackers weaponise this memory corruption to break runtime isolation. In active campaigns, this leads to:

1. Arbitrary Code Execution: The attacker executes shellcode directly inside the browser’s renderer process, gaining the ability to hijack the user’s browsing session.

2. Sandbox Escape and Full Compromise: Combined with OS or sandbox bypasses, attackers can break out of the browser to install malware, spyware, or trojans.

3. Credential and Session Theft: Attackers can intercept active browser session cookies, passwords, cached tokens, and confidential corporate web portal data.

How to Safeguard Your Organisation and Devices

1. Immediate Patch Management (Critical): Promptly update Google Chrome across all Windows, macOS, and Linux endpoints via Settings > About Chrome and relaunch the browser to apply the patch. As the V8 engine is shared across Chromium, also update alternative Chromium-based browsers (e.g., Edge, Brave, Opera) to patched versions.

2. Deploy Web & DNS Filtering: Use secure web gateways, DNS filtering, and Endpoint Detection and Response (EDR) solutions to block connections to known malicious domains and flag anomalous child processes spawned by browser executables.

3. Enforce Enterprise Auto-Update Policies: System administrators should use Group Policy Objects (GPO), Microsoft Intune, or Mobile Device Management (MDM) solutions (such as TrendMicro) to enforce automatic browser updates and mandate prompt browser restarts.