Chrome Ships Emergency V8 Fix for CVE-2026-11645 Already Under Attack
An out-of-bounds read/write in V8 is being exploited in the wild. Google's update covers 74 issues. Patch, then verify your browser fleet actually restarted.
Google pushed a Chrome update this week that closes 74 security holes, and one of them is already being hit in the wild.
The live bug is CVE-2026-11645, an out-of-bounds memory access in V8, the JavaScript and WebAssembly engine that does the heavy lifting inside every Chromium tab. CVSS 8.8. High severity. The fix lands in Chrome 149.0.7827.103 and later.
Out-of-bounds read and write in the same primitive is the kind of finding exploit developers circle in red pen. A read leaks memory layout. A write corrupts it. Chain them together inside a JIT engine and you have a renderer compromise that typically pairs with a sandbox escape for full code execution. Google has not published exploitation details, which is standard practice while the patch rolls out.
This is not an identity bug. But it sits squarely in the path of every federated login your users touch.
Think about what lives in a Chrome process. OIDC ID tokens in memory. Session cookies bound — or, more often, not bound — to the device. Refresh tokens cached by SPAs that ignored the advice in RFC 6749 §10.4 about rotation. A renderer-level read primitive against a logged-in browser is a credential theft primitive, full stop.
Would MFA have helped? Honestly, not much here. Phishing-resistant WebAuthn protects the authentication step. Once a session cookie exists and is exfiltrated, the attacker reuses it and the IdP sees a perfectly valid request. That is an authz problem masquerading as an auth problem.
The defenses that actually matter for this class of bug:
- Device-bound session credentials. Google's DBSC proposal is the long game; until it ships broadly, treat exfiltrated cookies as game over.
- Short refresh-token lifetimes with rotation and reuse detection on the IdP side.
Patch guidance is unambiguous. Verify Chrome reports 149.0.7827.103 or newer under chrome://settings/help. Edge, Brave, Opera, Arc and friends will follow on their own cadence — check each one rather than assuming the Chromium tide lifts all boats simultaneously.
For managed fleets, the relevant policy is RelaunchNotificationPeriod. Setting it and walking away is not the same as confirming restarts happened. Pull telemetry. A browser that downloaded the update but never relaunched is still vulnerable, and users are remarkably good at clicking "Later" for three weeks.
This is Chrome's latest actively-exploited V8 issue in a long line of actively-exploited V8 issues. The engine is a soft target because it is the only place on most endpoints where attacker-controlled code gets JIT-compiled by design. Expect more. Plan your update SLAs accordingly.
