CVE-2026-11645: Out of bounds read and write in V8 in Google Chrome prior to 149

Synopsis

An out-of-bounds read and write vulnerability exists in V8, the JavaScript engine embedded in Google Chrome versions prior to 149.0.7827.103. The flaw is reachable over the network and requires no authentication, but does require the victim to visit a crafted HTML page. Successful exploitation gives a remote attacker arbitrary code execution inside the Chrome sandbox. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account or credential is needed; the attacker requires only that the victim's browser loads the malicious page.

• Victim interactionRequired

  The victim must navigate to or be redirected to the crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Executes arbitrary code within the Chrome renderer sandbox, giving the attacker full control over the renderer process.
• Reads in-process memory, exposing session tokens, cached credentials, and page content loaded in the affected tab.
• Writes to in-process memory, enabling modification of page content, script execution context, or internal V8 structures.
• Crashes the renderer process if the attacker triggers the out-of-bounds access without a controlled payload, disrupting the browsing session.