CVE-2026-11645KEV · OVERDUE

Google Chromium V8 Out-of-Bounds Read and Write Vulnerability

High · published June 8, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 84.2th percentile for exploit probability.

123
days past CISA
deadline
CVSS v3.1
8.8
EPSS
2%
Percentile
84.2
In the wild
Confirmed
What it is

Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02440 · 84.2th percentile
Published
2026-06-08T23:27Z
KEV added
2026-06-09 · due 2026-06-23
EPSS history
Timeline
  • 09 JUN 00:00Z
    Added to CISA KEV — remediate by Jun 23
    kev
  • 08 JUN 23:27Z
    Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted…
    cvelistv5