Loading story…
Google has patched CVE-2026-11645, an actively exploited flaw in Chrome’s V8 JavaScript and WebAssembly engine that can give attackers both out-of-bounds read and write capabilities from a crafted web page. The bug affects Chrome prior to 149.0.7827.103 on Windows and macOS and 149.0.7827.102 on Linux, creating a realistic drive-by compromise path in which renderer-process code execution could be chained with a sandbox escape for full device takeover. Public reporting notes that Google confirmed in-the-wild exploitation but did not disclose the campaign, attribution, or full exploit chain.
The risk is amplified across the broader Chromium ecosystem because many Electron and Chromium-based applications ship their own embedded V8 runtimes and may remain vulnerable after browser updates. Historical Chromium issues and research around XSS Auditor and Chrome security bugs—including bypasses, cross-origin data extraction, form-data leakage through redirects, and Egor Homakov’s account of abusing Chrome bugs in an OAuth flow—underscore how browser flaws can expose sensitive data or be combined into larger attack chains. Organizations are being pushed to update Chrome immediately and inventory Chromium-derived applications that may require separate patch cycles.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-11645, a Chrome V8 out-of-bounds read/write vulnerability, to its Known Exploited Vulnerabilities catalog after active exploitation was confirmed. The reference states the KEV addition occurred on this date.
A Chromium security issue documented that the body of a POST request in a 302 redirect chain could be recovered by script on the final page using XSS Auditor. This expanded public reporting on data leakage risks tied to the feature.
A Chromium security issue reported that XSS Auditor behavior could leak submitted form data through an about:blank redirection flow. The issue described exposure of POSTed information caused by browser handling of redirects.
A Chromium issue documented that universal cross-site scripting could be performed because XSS Auditor processed tokens inside script tags separately. The report described a flaw that could enable broader script injection impact.
Egor Homakov published a blog post titled "How we hacked Facebook with OAuth2 and Chrome bugs." The post publicly tied Chrome XSS Auditor-related flaws to a real attack scenario involving Facebook OAuth2.
A Chromium issue was published describing data extraction made possible through XSS Auditor behavior. The report showed that the protection mechanism itself could be abused to leak information.
A Chromium security issue reported an XSSAuditor bypass using a leading comment pattern `/*///*/`. The report documented another technique for defeating the browser's XSS filtering logic.
A Chromium security issue documenting an XSS Auditor bypass using SVG tags was published. This indicates an early reported weakness in Chrome's XSS Auditor protections.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
codeby.net
Open sourcecode.google.com
Open sourcecode.google.com
Open sourcecode.google.com
Open sourcehomakov.blogspot.jp
Open sourcecode.google.com
Open sourcecode.google.com
Open sourcecode.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released Chrome desktop updates to fix multiple security vulnerabilities, including **actively exploited zero-days** affecting versions older than `125.0.6422.60/.61` on Windows and macOS and older than `125.0.6422.60` on Linux. The most serious issue, `CVE-2024-4947`, is a high-severity **type confusion** flaw in the V8 JavaScript engine that can lead to out-of-bounds memory access and potentially remote code execution; Google said an exploit for the bug exists in the wild. The updates also addressed other flaws, including `CVE-2024-4761`, an out-of-bounds write in V8 and WebAssembly, `CVE-2024-4671`, a use-after-free issue in Visuals, `CVE-2024-4948`, a use-after-free in Dawn, `CVE-2024-4949`, a use-after-free in V8, and `CVE-2024-4950`, an implementation issue in Downloads. Google and national CSIRT reporting warned that successful exploitation could enable code execution, crashes, or exposure of sensitive data, and urged users to update Chrome immediately while some technical details remain temporarily restricted until broad patch adoption.
Aug 15, 2026
Google has released an emergency security update to address CVE-2025-13223, a critical zero-day vulnerability in the V8 JavaScript engine used by Chrome and Chromium-based browsers. This type confusion flaw, discovered by Clément Lecigne of Google’s Threat Analysis Group (TAG), allows attackers to achieve heap corruption and potentially execute arbitrary code simply by luring users to maliciously crafted websites. The vulnerability has been actively exploited in the wild, with Google confirming that threat actors are weaponizing it to bypass browser sandbox protections, steal credentials, escalate privileges, and deploy malware. The fix is included in Chrome version 142.0.7444.175/.176 for Windows, Mac, and Linux, and users are strongly urged to update and restart their browsers immediately to mitigate risk. Other Chromium-based browsers, including Microsoft Edge, Brave, Opera, and Vivaldi, are also rolling out patches. The involvement of Google TAG suggests possible links to advanced persistent threats, highlighting the urgency for both individuals and enterprises to apply updates and monitor for suspicious activity.
Jun 29, 2026
Google released Chrome fixes for multiple high-severity vulnerabilities in the V8 JavaScript engine, including `CVE-2025-10891`, `CVE-2025-10892`, and `CVE-2025-9864`, that could be triggered when a user visits a malicious web page. The flaws include integer overflows and a use-after-free condition that can cause heap corruption in the browser renderer and potentially lead to arbitrary code execution. A related bulletin also lists `CVE-2025-10890`, a V8 side-channel information disclosure issue, alongside the two integer overflow bugs, warning that successful exploitation could expose sensitive data or enable full system compromise. Google said the affected Chrome builds were patched across Windows, macOS, and Linux in the `140.0.7339` release line, with fixes landing in versions including `140.0.7339.80/.81` and later `140.0.7339.207/.208` depending on the flaw and platform. Several of the vulnerabilities were reportedly identified by Google’s AI-based Big Sleep system, and no public proof-of-concept exploits were cited in the referenced reports. Organizations using Chrome or Chromium-based browsers were urged to deploy the vendor updates promptly because the bugs are reachable through routine web browsing and may also affect downstream browsers that have not yet incorporated the upstream patches.
Jun 29, 2026