Chrome V8 Out-of-Bounds Memory Access RCE (CVE-2026-11645) | MSSP Advisory

Risk Assessment

Google has patched CVE-2026-11645, an out-of-bounds memory access flaw in the V8 JavaScript engine affecting Chrome versions prior to 149.0.7827.103, and has confirmed active exploitation in the wild. A remote attacker can execute arbitrary code inside the Chrome sandbox by directing a target to a crafted HTML page, requiring no user interaction beyond visiting the page. This is the fifth actively exploited Chrome zero-day patched by Google so far in 2026, which tells you the targeting cadence on browser-based entry points is not slowing down.

Every technician on your team is running Chrome or a Chromium-based browser while logged into your RMM, PSA, and client portals, which means a single malicious page visit can hand an attacker a foothold inside the same browser session that holds your client credentials and remote access tokens. On the client side, your managed endpoints are almost certainly running unpatched Chrome right now, and if one of those users gets hit before you push the update, you own that conversation about why you did not act faster. This is not a theoretical risk, Google has confirmed exploitation is already happening.