Chrome Patches Its Fifth Exploited Zero-Day of 2026, a V8 Memory Bug

Google shipped a Chrome update on June 9, 2026 that fixes 74 vulnerabilities, among them CVE-2026-11645, a flaw in the V8 JavaScript and WebAssembly engine that Google says is being exploited in the wild. It is the fifth Chrome zero-day patched this year.

What happened

CVE-2026-11645 is an out-of-bounds read and write bug in V8, the engine that runs JavaScript in Chrome and every Chromium-based browser. Memory-safety flaws of this type let a crafted web page corrupt memory inside the browser's renderer process, often the first step in an attack chain. As is Google's habit with exploited bugs, technical detail is thin until most users have updated. The company confirmed active exploitation but has not said who is behind it.

Because the engine is shared, the fix matters well beyond Chrome. Microsoft Edge, Brave, Opera and Vivaldi inherit Chromium patches and typically ship their own updates within days. Enterprises that pin browser versions are the ones most likely to lag.

A pattern in the components

The list is dominated by the browser's rendering and scripting internals. V8 appears twice, Skia, the 2D graphics library, once, and the newer WebGPU stack once, alongside a CSS use-after-free in February. New features expand attack surface: WebGPU in particular exposes the graphics driver and a large body of C++ code to untrusted web content. Most of these bugs are memory errors, the class that languages with memory safety and Chrome's sandbox and mitigations aim to contain.

Why it matters

Browser zero-days are prized by commercial spyware vendors and state-linked groups because they work on a target's own device with a single click on a link. For defenders the response is operational: auto-update must be on, and managed fleets need a short window between Chromium release and deployment. Chrome typically applies fixes silently, but a restart is required for them to take effect, a step users routinely postpone.

How a browser exploit chain works, at a high level

A single bug is rarely enough for a full compromise. Modern browsers isolate each web page in a sandboxed renderer process with limited privileges, so an attacker who gains code execution through a V8 flaw is still confined. To reach the underlying system, they typically chain the renderer bug with a second flaw that escapes the sandbox, often in the operating system or the browser's privileged processes. Google's habit of crediting its Threat Analysis Group or outside researchers for discovery, and of withholding details, reflects the fact that the other half of the chain may still be unpatched elsewhere.

That model also explains why vendors sometimes say very little. When the release notes say only that an exploit "exists in the wild", defenders have to infer urgency from the severity rating and from any listing in CISA's Known Exploited Vulnerabilities catalogue, which sets a binding deadline for US federal agencies. For everyone else, the right assumption is that the patch should be treated as an emergency.

V8 is a recurring target because of its design. To run JavaScript quickly it compiles code on the fly and makes aggressive assumptions about object types, and bugs in those optimisations can produce memory corruption that attackers shape into a reliable exploit. The engine receives continuous fuzzing and hardening, and Chrome has added mitigations such as a V8 sandbox to limit what a corrupted engine can touch, but the codebase is large and fast-moving. WebGPU adds a newer surface: it brings low-level graphics access to the web, and bugs in the Dawn implementation can expose driver behaviour that is hard to test exhaustively.

In a typical corporate environment the weak spot is not Chrome's engineering but deployment. Extended-support channels, kiosk machines and virtual desktops can sit on old builds for weeks. Security teams should measure the time from Google's stable release to full rollout, not just whether auto-update is enabled, and apply the same discipline to embedded Chromium in desktop apps such as Electron programs, which update on each vendor's own schedule.

What to watch

• Further advisories attributing the exploits to spyware vendors or state actors.
• Whether a sixth exploited zero-day lands before year-end; we found none reported after June.
• CISA KEV additions that set patch deadlines for federal agencies running Chromium browsers.

Sources

1. Google patches Chrome zero-day exploited in the wild (CVE-2026-11645) — Help Net Security
2. Google patches fifth Chrome zero-day bug exploited in attacks this year — BleepingComputer
3. Google Releases Patch for Fourth Chrome Zero-Day of 2026 Exploited in the Wild — ThaiCERT
4. Google fixes first actively exploited Chrome zero-day of 2026 — Security Affairs