V8 in Google Chrome before 149.0.7827.103 is affected by CVE-2026-11645, an out-of-bounds read and write. A remote attacker can use crafted HTML to execute arbitrary code inside the Chrome sandbox. The CNA lists Chromium severity High. This record alone does not establish a sandbox escape or full compromise of the host.
Vulnerability Overview and Scope of Impact
Update desktop Chrome to 149.0.7827.103 or later and, after restarting, verify the running version at chrome://settings/help. Update other Chromium-based browsers to a vendor release that incorporates the same fix.
Specific Impacts / Attack Scenarios
Attacks exploiting this vulnerability typically begin by luring users to malicious websites. When a user loads a malicious HTML page, the vulnerability is triggered, allowing attackers to bypass the browser's security sandbox and execute unauthorized code on the victim's computer. This can lead to a wide range of damages, including the theft of confidential information, installation of malware, and complete system control. Web developers and users who frequently browse the internet are particularly susceptible to these types of drive-by download attacks and should exercise caution.
Immediate Actions for Engineers
The published Chrome CNA record does not state that this vulnerability was exploited in the wild. This article therefore avoids an unverified zero-day or active-exploitation claim and reports only the confirmed impact and fixed release. Use Chrome's built-in updater or managed enterprise software deployment to install the update.
📦