Critical Zero‑Day in Chrome V8 Engine (CVE‑2026‑11645) Enables Remote Code Execution
What It Is – Google disclosed a high‑severity, out‑of‑bounds read/write flaw in Chrome’s V8 JavaScript engine (CVE‑2026‑11645). The vulnerability allows a remote attacker to execute arbitrary code inside the browser sandbox via a malicious HTML page.
Exploitability – An active exploit is confirmed “in the wild.” Google released an emergency patch in Chrome 149.0.7827.102/103 (Windows/macOS) and 149.0.7827.102 (Linux). No public PoC is available, but the existence of a live exploit drives the CVSS score into the Critical range (≥9.0).
Affected Products – Google Chrome 149.0.7827.102/103 and earlier versions on Windows, macOS, and Linux. Any organization that permits Chrome as a primary browser is exposed.
TPRM Impact –
- Employee browsers are a direct attack surface; compromise can lead to credential theft, malware drop, or lateral movement inside the corporate network.
- SaaS and web‑based applications accessed via Chrome inherit this risk, creating a supply‑chain vector for third‑party services.
Recommended Actions –
- Immediate Patch Deployment – Push Chrome 149.0.7827.102 (or later) to all endpoints via your patch management system.
- Enforce Auto‑Update – Verify that automatic updates are enabled and cannot be overridden by users.
- Threat Hunting – Scan logs for known Indicators of Compromise (IoCs) related to CVE‑2026‑11645 exploitation (e.g., suspicious HTML payloads, anomalous V8 activity).
- Browser Isolation – For high‑risk users (finance, HR, executive), consider sandboxed or remote‑browser isolation solutions until full remediation is confirmed.
- Vendor Communication – Notify any SaaS providers that rely on Chrome‑based client components of the patch status and confirm they have applied the fix.
Source: Help Net Security – Google patches Chrome zero‑day exploited in the wild (CVE‑2026‑11645)